霍雅
追求源于热爱，极致源于梦想！
2025羊城杯初赛re 完整wp
10/14
ez_py
先用pyinstxtractor解包exe
然后尝试反编译pyc
但是用了在线网站会少东西
# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: key.py
# Bytecode version: 3.13.0rc3 (3571)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)
import ast
import types
import sys
o0o0o0 = [105084753, 3212558540, 351342182, 844102737, 2002504052, 356536456, 2463183122, 615034880, 1156203296]
def changli(o0o0o1, o0o0o2, o0o0o3):
o0o0o4 = 2269471011
o0o0o5 = o0o0o3 & 4294967295
o0o0o6 = (o0o0o3 >> 8 ^ 305419896) & 4294967295
o0o0o7 = (o0o0o3 << 4 ^ 2271560481) & 4294967295
o0o0o8 = (o0o0o3 >> 12 ^ 2882400000) & 4294967295
o0o0o9 = o0o0o1 & 4294967295
o0o0o10 = o0o0o2 & 4294967295
o0o0o11 = 0
for _ in range(32):
o0o0o11 = o0o0o11 + o0o0o4 & 4294967295
o0o0o9 = o0o0o9 + ((o0o0o10 << 4) + o0o0o5 ^ o0o0o10 + o0o0o11 ^ (o0o0o10 >> 4) + o0o0o6) & 4294967295
o0o0o10 = o0o0o10 + ((o0o0o9 << 4) + o0o0o7 ^ o0o0o9 + o0o0o11 ^ (o0o0o9 >> 4) + o0o0o8) & 4294967295
return (o0o0o9, o0o0o10)
def Shorekeeper(o0o0o12):
o0o0o13 = o0o0o12 >> 16
o0o0o14 = o0o0o12 & 65535
return (o0o0o13, o0o0o14)
def Kathysia(o0o0o15, o0o0o16):
return o0o0o15 << 16 | o0o0o16 + 0
def Phrolova(o0o0o17):
o0oA = 'Carlotta'
o0oB = ['o0oC', 'o0oD', 'o0oE', 'o0oF']
o0oG = []
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oH', ctx=ast.Store())], value=ast.Constant(305419896)))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oI', ctx=ast.Store())], value=ast.BinOp(ast.Name(id='o0oE', ctx=ast.Load()), ast.BitAnd(), ast.Constant(65535))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oJ', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.Name(id='o0oE', ctx=ast.Load()), ast.RShift(), ast.Constant(16)), ast.BitAnd(), ast.Constant(65535))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oK', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.Name(id='o0oE', ctx=ast.Load()), ast.BitXor(), ast.Name(id='o0oF', ctx=ast.Load())), ast.BitAnd(), ast.Constant(65535))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oL', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.Name(id='o0oE', ctx=ast.Load()), ast.RShift(), ast.Constant(8)), ast.BitXor(), ast.Name(id='o0oF', ctx=ast.Load())), ast.BitAnd(), ast.Constant(65535)))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oM', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.Name(id='o0oH', ctx=ast.Load()), ast.Mult(), ast.BinOp(ast.Name(id='o0oF', ctx=ast.Load()), ast.Add(), ast.Constant(1))), ast.BitAnd(), ast.Constant(4294967295))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oN', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.BinOp(ast.Name(id='o0oD', ctx=ast.Load()), ast.LShift(), ast.Constant(5)), ast.Add(), ast.Add(), ast.Constant(5)), ast.Add(), ast.Name(id='o0oJ', ctx=ast.Load()))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oP', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.Name(id='o0oC', ctx=ast.Load()), ast.Add(), ast.Name(id='o0oN', ctx=ast.Load())), ast.BitAnd(), ast.Constant(65535))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oN', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.BinOp(ast.Name(id='o0oP', ctx=ast.Load()), ast.LShift(), ast.Constant(5)), ast.Add(), ast.Add(), ast.Constant(5)), ast.Add(), ast.Name(id='o0oL', ctx=ast.Load()))))
o0oG.append(ast.Assign(targets=[ast.Name(id='o0oQ', ctx=ast.Store())], value=ast.BinOp(ast.BinOp(ast.Name(id='o0oD', ctx=ast.Load()), ast.Add(), ast.Name(id='o0oN', ctx=ast.Load())), ast.BitAnd(), ast.Constant(65535))))
o0oG.append(ast.Return(ast.Tuple(elts=[ast.Name(id='o0oP', ctx=ast.Load()), ast.Name(id='o0oQ', ctx=ast.Load())], ctx=ast.Load())))
o0oU = ast.FunctionDef(name=o0oA, args=ast.arguments(posonlyargs=[], args=[ast.arg(arg=a) for a in o0oB], kwonlyargs=[], kw_defaults=[], defaults=[]), body=o0oG, decorator_list=[])
o0oV = ast.parse('\ndef _tea_helper_func(a, b, c):\n magic1 = (a ^ b) & 0xDEADBEEF\n magic2 = (c << 3) | (a >> 5)\n return (magic1 + magic2 - (b & 0xCAFEBABE)) & 0xFFFFFFFF\n\ndef _fake_tea_round(x, y):\n return ((x * 0x9E3779B9) ^ (y + 0x12345678)) & 0xFFFFFFFF\n\n_tea_magic_delta = 0x9E3779B9 ^ 0x12345678\n_tea_dummy_keys = [0x1111, 0x2222, 0x3333, 0x4444]\n').body
o0oW = ast.Module(body=[o0oU] + o0oV, type_ignores=[])
ast.fix_missing_locations(o0oW)
o0oX = compile(o0oW, filename='<tea_obf_ast>', mode='exec')
o0oY = {}
exec(o0oX, o0oY)
if o0oA in o0oY:
o0o0o17[o0oA] = o0oY[o0oA]
return None
Phrolova(globals())
def shouan(o0o0o32):
raise ValueError('需要输入9个key') if len(o0o0o32)!= 9 else None
def jinhsi():
print('请输入9个数字:')
try:
o0o0o46 = input().strip()
if ',' in o0o0o46:
o0o0o42 = o0o0o46.split(',')
if len(o0o0o42)!= 9:
print('错误: 需要输入9个数')
return None
except Exception as o0o0o47:
print(f'发生错误: {o0o0o47}')
if __name__ == '__main__':
jinhsi()所以我们要看字节码
使用xdis
# pydisasm version 6.1.3
# Python bytecode 3.13.0 (3571)
# Disassembled from Python 3.12.3 (tags/v3.12.3:f6650f9, Apr 9 2024, 14:05:25) [MSC v.1938 64 bit (AMD64)]
# Timestamp in code: 0 (1970-01-01 08:00:00)
# Source code size mod 2**32: 0 bytes
# Method Name: <module>
# Filename: key.py
# Argument count: 0
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 0
# Stack size: 4
# Flags: 0x00000000 (0x0)
# First Line: 1
# Constants:
# 0: 0
# 1: None
# 2: (105084753, 3212558540L, 351342182, 844102737, 2002504052, 356536456, 2463183122L, 615034880, 1156203296)
# 3: <Code311 code object changli at 0x228b3e9b740, file key.py>, line 8
# 4: <Code311 code object Shorekeeper at 0x228b44667e0, file key.py>, line 27
# 5: <Code311 code object Kathysia at 0x228b3e98f80, file key.py>, line 32
# 6: <Code311 code object Phrolova at 0x228b4467380, file key.py>, line 35
# 7: <Code311 code object shouan at 0x228b4467590, file key.py>, line 202
# 8: <Code311 code object jinhsi at 0x228b4467920, file key.py>, line 222
# 9: '__main__'
# Names:
# 0: ast
# 1: types
# 2: sys
# 3: o0o0o0
# 4: changli
# 5: Shorekeeper
# 6: Kathysia
# 7: Phrolova
# 8: globals
# 9: shouan
# 10: jinhsi
# 11: __name__
0: 0 RESUME 0
1: 2 LOAD_CONST (0)
4 LOAD_CONST (None)
6 IMPORT_NAME (ast)
8 STORE_NAME (ast)
2: 10 LOAD_CONST (0)
12 LOAD_CONST (None)
14 IMPORT_NAME (types)
16 STORE_NAME (types)
3: 18 LOAD_CONST (0)
20 LOAD_CONST (None)
22 IMPORT_NAME (sys)
24 STORE_NAME (sys)
6: 26 BUILD_LIST 0
28 LOAD_CONST ((105084753, 3212558540L, 351342182, 844102737, 2002504052, 356536456, 2463183122L, 615034880, 1156203296))
30 LIST_EXTEND 1
32 STORE_NAME (o0o0o0)
8: 34 LOAD_CONST (<Code311 code object changli at 0x228b3e9b740, file key.py>, line 8)
36 MAKE_FUNCTION
38 STORE_NAME (changli)
27: 40 LOAD_CONST (<Code311 code object Shorekeeper at 0x228b44667e0, file key.py>, line 27)
42 MAKE_FUNCTION
44 STORE_NAME (Shorekeeper)
32: 46 LOAD_CONST (<Code311 code object Kathysia at 0x228b3e98f80, file key.py>, line 32)
48 MAKE_FUNCTION
50 STORE_NAME (Kathysia)
35: 52 LOAD_CONST (<Code311 code object Phrolova at 0x228b4467380, file key.py>, line 35)
54 MAKE_FUNCTION
56 STORE_NAME (Phrolova)
200: 58 LOAD_NAME (Phrolova)
60 PUSH_NULL
62 LOAD_NAME (globals)
64 PUSH_NULL
66 CALL 0
74 CALL 1
82 POP_TOP
202: 84 LOAD_CONST (<Code311 code object shouan at 0x228b4467590, file key.py>, line 202)
86 MAKE_FUNCTION
88 STORE_NAME (shouan)
222: 90 LOAD_CONST (<Code311 code object jinhsi at 0x228b4467920, file key.py>, line 222)
92 MAKE_FUNCTION
94 STORE_NAME (jinhsi)
257: 96 LOAD_NAME (__name__)
98 LOAD_CONST ("__main__")
100 COMPARE_OP (==)
104 POP_JUMP_IF_FALSE (to 124)
258: 108 LOAD_NAME (jinhsi)
110 PUSH_NULL
112 CALL 0
120 POP_TOP
122 RETURN_CONST (None)
257: >> 124 RETURN_CONST (None)
# Method Name: changli
# Filename: key.py
# Argument count: 3
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 12
# Stack size: 5
# Flags: 0x00000003 (NEWLOCALS | OPTIMIZED)
# First Line: 8
# Constants:
# 0: None
# 1: 2269471011L
# 2: 4294967295L
# 3: 8
# 4: 305419896
# 5: 4
# 6: 2271560481L
# 7: 12
# 8: 2882400000L
# 9: 0
# 10: 32
# Names:
# 0: range
# Varnames:
# o0o0o1, o0o0o2, o0o0o3, o0o0o4, o0o0o5, o0o0o6, o0o0o7, o0o0o8, o0o0o9, o0o0o10, o0o0o11, _
# Positional arguments:
# o0o0o1, o0o0o2, o0o0o3
# Local variables:
# 3: o0o0o4
# 4: o0o0o5
# 5: o0o0o6
# 6: o0o0o7
# 7: o0o0o8
# 8: o0o0o9
# 9: o0o0o10
# 10: o0o0o11
# 11: _
8: 0 RESUME 0
10: 2 LOAD_CONST (2269471011L)
4 STORE_FAST (o0o0o4)
11: 6 LOAD_FAST (o0o0o3)
8 LOAD_CONST (4294967295L)
10 BINARY_OP (&)
14 STORE_FAST (o0o0o5)
12: 16 LOAD_FAST (o0o0o3)
18 LOAD_CONST (8)
20 BINARY_OP (>>)
24 LOAD_CONST (305419896)
26 BINARY_OP (^)
30 LOAD_CONST (4294967295L)
32 BINARY_OP (&)
36 STORE_FAST (o0o0o6)
13: 38 LOAD_FAST (o0o0o3)
40 LOAD_CONST (4)
42 BINARY_OP (<<)
46 LOAD_CONST (2271560481L)
48 BINARY_OP (^)
52 LOAD_CONST (4294967295L)
54 BINARY_OP (&)
58 STORE_FAST (o0o0o7)
14: 60 LOAD_FAST (o0o0o3)
62 LOAD_CONST (12)
64 BINARY_OP (>>)
68 LOAD_CONST (2882400000L)
70 BINARY_OP (^)
74 LOAD_CONST (4294967295L)
76 BINARY_OP (&)
80 STORE_FAST (o0o0o8)
16: 82 LOAD_FAST (o0o0o1)
84 LOAD_CONST (4294967295L)
86 BINARY_OP (&)
90 STORE_FAST (o0o0o9)
17: 92 LOAD_FAST (o0o0o2)
94 LOAD_CONST (4294967295L)
96 BINARY_OP (&)
100 STORE_FAST (o0o0o10)
18: 102 LOAD_CONST (0)
104 STORE_FAST (o0o0o11)
20: 106 LOAD_GLOBAL (NULL + range)
116 LOAD_CONST (32)
118 CALL 1
126 GET_ITER
128 FOR_ITER (to 260)
132 STORE_FAST (_)
21: 134 LOAD_FAST_LOAD_FAST (o0o0o11, o0o0o4)
136 BINARY_OP (+)
140 LOAD_CONST (4294967295L)
142 BINARY_OP (&)
146 STORE_FAST (o0o0o11)
22: 148 LOAD_FAST_LOAD_FAST (o0o0o9, o0o0o10)
150 LOAD_CONST (4)
152 BINARY_OP (<<)
156 LOAD_FAST (o0o0o5)
158 BINARY_OP (+)
162 LOAD_FAST_LOAD_FAST (o0o0o10, o0o0o11)
164 BINARY_OP (+)
168 BINARY_OP (^)
172 LOAD_FAST (o0o0o10)
174 LOAD_CONST (4)
176 BINARY_OP (>>)
180 LOAD_FAST (o0o0o6)
182 BINARY_OP (+)
186 BINARY_OP (^)
190 BINARY_OP (+)
194 LOAD_CONST (4294967295L)
196 BINARY_OP (&)
200 STORE_FAST (o0o0o9)
23: 202 LOAD_FAST_LOAD_FAST (o0o0o10, o0o0o9)
204 LOAD_CONST (4)
206 BINARY_OP (<<)
210 LOAD_FAST (o0o0o7)
212 BINARY_OP (+)
216 LOAD_FAST_LOAD_FAST (o0o0o9, o0o0o11)
218 BINARY_OP (+)
222 BINARY_OP (^)
226 LOAD_FAST (o0o0o9)
228 LOAD_CONST (4)
230 BINARY_OP (>>)
234 LOAD_FAST (o0o0o8)
236 BINARY_OP (+)
240 BINARY_OP (^)
244 BINARY_OP (+)
248 LOAD_CONST (4294967295L)
250 BINARY_OP (&)
254 STORE_FAST (o0o0o10)
256 JUMP_BACKWARD (to 128)
20: >> 260 END_FOR
262 POP_TOP
25: 264 LOAD_FAST_LOAD_FAST (o0o0o9, o0o0o10)
266 BUILD_TUPLE 2
268 RETURN_VALUE
# Method Name: Shorekeeper
# Filename: key.py
# Argument count: 1
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 3
# Stack size: 2
# Flags: 0x00000003 (NEWLOCALS | OPTIMIZED)
# First Line: 27
# Constants:
# 0: None
# 1: 16
# 2: 65535
# Varnames:
# o0o0o12, o0o0o13, o0o0o14
# Positional arguments:
# o0o0o12
# Local variables:
# 1: o0o0o13
# 2: o0o0o14
27: 0 RESUME 0
28: 2 LOAD_FAST (o0o0o12)
4 LOAD_CONST (16)
6 BINARY_OP (>>)
10 STORE_FAST (o0o0o13)
29: 12 LOAD_FAST (o0o0o12)
14 LOAD_CONST (65535)
16 BINARY_OP (&)
20 STORE_FAST (o0o0o14)
30: 22 LOAD_FAST_LOAD_FAST (o0o0o13, o0o0o14)
24 BUILD_TUPLE 2
26 RETURN_VALUE
# Method Name: Kathysia
# Filename: key.py
# Argument count: 2
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 2
# Stack size: 3
# Flags: 0x00000003 (NEWLOCALS | OPTIMIZED)
# First Line: 32
# Constants:
# 0: None
# 1: 16
# 2: 0
# Varnames:
# o0o0o15, o0o0o16
# Positional arguments:
# o0o0o15, o0o0o16
32: 0 RESUME 0
33: 2 LOAD_FAST (o0o0o15)
4 LOAD_CONST (16)
6 BINARY_OP (<<)
10 LOAD_FAST (o0o0o16)
12 LOAD_CONST (0)
14 BINARY_OP (+)
18 BINARY_OP (|)
22 RETURN_VALUE
# Method Name: Phrolova
# Filename: key.py
# Argument count: 1
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 10
# Stack size: 20
# Flags: 0x00000003 (NEWLOCALS | OPTIMIZED)
# First Line: 35
# Constants:
# 0: None
# 1: 'Carlotta'
# 2: ('o0oC', 'o0oD', 'o0oE', 'o0oF')
# 3: 'o0oH'
# 4: ('id', 'ctx')
# 5: 305419896
# 6: ('targets', 'value')
# 7: 'o0oI'
# 8: 'o0oE'
# 9: 65535
# 10: 'o0oJ'
# 11: 16
# 12: 'o0oK'
# 13: 'o0oF'
# 14: 'o0oL'
# 15: 8
# 16: 'o0oM'
# 17: 1
# 18: 4294967295L
# 19: 'o0oN'
# 20: 'o0oD'
# 21: 5
# 22: 'o0oP'
# 23: 'o0oC'
# 24: 'o0oQ'
# 25: ('elts', 'ctx')
# 26: ('arg',)
# 27: ('posonlyargs', 'args', 'kwonlyargs', 'kw_defaults', 'defaults')
# 28: ('name', 'args', 'body', 'decorator_list')
# 29: '\ndef _tea_helper_func(a, b, c):\n magic1 = (a ^ b) & 0xDEADBEEF\n magic2 = (c << 3) | (a >> 5)\n return (magic1 + magic2 - (b & 0xCAFEBABE)) & 0xFFFFFFFF\n\ndef _fake_tea_round(x, y):\n return ((x * 0x9E3779B9) ^ (y + 0x12345678)) & 0xFFFFFFFF\n\n_tea_magic_delta = 0x9E3779B9 ^ 0x12345678\n_tea_dummy_keys = [0x1111, 0x2222, 0x3333, 0x4444]\n'
# 30: ('body', 'type_ignores')
# 31: '<tea_obf_ast>'
# 32: 'exec'
# 33: ('filename', 'mode')
# Names:
# 0: append
# 1: ast
# 2: Assign
# 3: Name
# 4: Store
# 5: Constant
# 6: BinOp
# 7: Load
# 8: BitAnd
# 9: RShift
# 10: BitXor
# 11: Mult
# 12: Add
# 13: LShift
# 14: Return
# 15: Tuple
# 16: FunctionDef
# 17: arguments
# 18: arg
# 19: parse
# 20: body
# 21: Module
# 22: fix_missing_locations
# 23: compile
# 24: exec
# Varnames:
# o0o0o17, o0oA, o0oB, o0oG, a, o0oU, o0oV, o0oW, o0oX, o0oY
# Positional arguments:
# o0o0o17
# Local variables:
# 1: o0oA
# 2: o0oB
# 3: o0oG
# 4: a
# 5: o0oU
# 6: o0oV
# 7: o0oW
# 8: o0oX
# 9: o0oY
35: 0 RESUME 0
37: 2 LOAD_CONST ("Carlotta")
4 STORE_FAST (o0oA)
38: 6 BUILD_LIST 0
8 LOAD_CONST (('o0oC', 'o0oD', 'o0oE', 'o0oF'))
10 LIST_EXTEND 1
12 STORE_FAST (o0oB)
39: 14 BUILD_LIST 0
16 STORE_FAST (o0oG)
41: 18 LOAD_FAST (o0oG)
20 LOAD_ATTR (NULL|self + append)
40 LOAD_GLOBAL (ast)
50 LOAD_ATTR (Assign)
70 PUSH_NULL
42: 72 LOAD_GLOBAL (ast)
82 LOAD_ATTR (Name)
102 PUSH_NULL
104 LOAD_CONST ("o0oH")
106 LOAD_GLOBAL (ast)
116 LOAD_ATTR (Store)
136 PUSH_NULL
138 CALL 0
146 LOAD_CONST (('id', 'ctx'))
148 CALL_KW 2
150 BUILD_LIST 1
43: 152 LOAD_GLOBAL (ast)
162 LOAD_ATTR (Constant)
182 PUSH_NULL
184 LOAD_CONST (305419896)
186 CALL 1
41: 194 LOAD_CONST (('targets', 'value'))
196 CALL_KW 2
198 CALL 1
206 POP_TOP
46: 208 LOAD_FAST (o0oG)
210 LOAD_ATTR (NULL|self + append)
230 LOAD_GLOBAL (ast)
240 LOAD_ATTR (Assign)
260 PUSH_NULL
47: 262 LOAD_GLOBAL (ast)
272 LOAD_ATTR (Name)
292 PUSH_NULL
294 LOAD_CONST ("o0oI")
296 LOAD_GLOBAL (ast)
306 LOAD_ATTR (Store)
326 PUSH_NULL
328 CALL 0
336 LOAD_CONST (('id', 'ctx'))
338 CALL_KW 2
340 BUILD_LIST 1
48: 342 LOAD_GLOBAL (ast)
352 LOAD_ATTR (BinOp)
372 PUSH_NULL
374 LOAD_GLOBAL (ast)
384 LOAD_ATTR (Name)
404 PUSH_NULL
406 LOAD_CONST ("o0oE")
408 LOAD_GLOBAL (ast)
418 LOAD_ATTR (Load)
438 PUSH_NULL
440 CALL 0
448 LOAD_CONST (('id', 'ctx'))
450 CALL_KW 2
452 LOAD_GLOBAL (ast)
462 LOAD_ATTR (BitAnd)
482 PUSH_NULL
484 CALL 0
492 LOAD_GLOBAL (ast)
502 LOAD_ATTR (Constant)
522 PUSH_NULL
524 LOAD_CONST (65535)
526 CALL 1
534 CALL 3
46: 542 LOAD_CONST (('targets', 'value'))
544 CALL_KW 2
546 CALL 1
554 POP_TOP
51: 556 LOAD_FAST (o0oG)
558 LOAD_ATTR (NULL|self + append)
578 LOAD_GLOBAL (ast)
588 LOAD_ATTR (Assign)
608 PUSH_NULL
52: 610 LOAD_GLOBAL (ast)
620 LOAD_ATTR (Name)
640 PUSH_NULL
642 LOAD_CONST ("o0oJ")
644 LOAD_GLOBAL (ast)
654 LOAD_ATTR (Store)
674 PUSH_NULL
676 CALL 0
684 LOAD_CONST (('id', 'ctx'))
686 CALL_KW 2
688 BUILD_LIST 1
53: 690 LOAD_GLOBAL (ast)
700 LOAD_ATTR (BinOp)
720 PUSH_NULL
54: 722 LOAD_GLOBAL (ast)
732 LOAD_ATTR (BinOp)
752 PUSH_NULL
754 LOAD_GLOBAL (ast)
764 LOAD_ATTR (Name)
784 PUSH_NULL
786 LOAD_CONST ("o0oE")
788 LOAD_GLOBAL (ast)
798 LOAD_ATTR (Load)
818 PUSH_NULL
820 CALL 0
828 LOAD_CONST (('id', 'ctx'))
830 CALL_KW 2
832 LOAD_GLOBAL (ast)
842 LOAD_ATTR (RShift)
862 PUSH_NULL
864 CALL 0
872 LOAD_GLOBAL (ast)
882 LOAD_ATTR (Constant)
902 PUSH_NULL
904 LOAD_CONST (16)
906 CALL 1
914 CALL 3
55: 922 LOAD_GLOBAL (ast)
932 LOAD_ATTR (BitAnd)
952 PUSH_NULL
954 CALL 0
56: 962 LOAD_GLOBAL (ast)
972 LOAD_ATTR (Constant)
992 PUSH_NULL
994 LOAD_CONST (65535)
996 CALL 1
53: 1004 CALL 3
51: 1012 LOAD_CONST (('targets', 'value'))
1014 CALL_KW 2
1016 CALL 1
1024 POP_TOP
60: 1026 LOAD_FAST (o0oG)
1028 LOAD_ATTR (NULL|self + append)
1048 LOAD_GLOBAL (ast)
1058 LOAD_ATTR (Assign)
1078 PUSH_NULL
61: 1080 LOAD_GLOBAL (ast)
1090 LOAD_ATTR (Name)
1110 PUSH_NULL
1112 LOAD_CONST ("o0oK")
1114 LOAD_GLOBAL (ast)
1124 LOAD_ATTR (Store)
1144 PUSH_NULL
1146 CALL 0
1154 LOAD_CONST (('id', 'ctx'))
1156 CALL_KW 2
1158 BUILD_LIST 1
62: 1160 LOAD_GLOBAL (ast)
1170 LOAD_ATTR (BinOp)
1190 PUSH_NULL
63: 1192 LOAD_GLOBAL (ast)
1202 LOAD_ATTR (BinOp)
1222 PUSH_NULL
1224 LOAD_GLOBAL (ast)
1234 LOAD_ATTR (Name)
1254 PUSH_NULL
1256 LOAD_CONST ("o0oE")
1258 LOAD_GLOBAL (ast)
1268 LOAD_ATTR (Load)
1288 PUSH_NULL
1290 CALL 0
1298 LOAD_CONST (('id', 'ctx'))
1300 CALL_KW 2
1302 LOAD_GLOBAL (ast)
1312 LOAD_ATTR (BitXor)
1332 PUSH_NULL
1334 CALL 0
1342 LOAD_GLOBAL (ast)
1352 LOAD_ATTR (Name)
1372 PUSH_NULL
1374 LOAD_CONST ("o0oF")
1376 LOAD_GLOBAL (ast)
1386 LOAD_ATTR (Load)
1406 PUSH_NULL
1408 CALL 0
1416 LOAD_CONST (('id', 'ctx'))
1418 CALL_KW 2
1420 CALL 3
64: 1428 LOAD_GLOBAL (ast)
1438 LOAD_ATTR (BitAnd)
1458 PUSH_NULL
1460 CALL 0
65: 1468 LOAD_GLOBAL (ast)
1478 LOAD_ATTR (Constant)
1498 PUSH_NULL
1500 LOAD_CONST (65535)
1502 CALL 1
62: 1510 CALL 3
60: 1518 LOAD_CONST (('targets', 'value'))
1520 CALL_KW 2
1522 CALL 1
1530 POP_TOP
69: 1532 LOAD_FAST (o0oG)
1534 LOAD_ATTR (NULL|self + append)
1554 LOAD_GLOBAL (ast)
1564 LOAD_ATTR (Assign)
1584 PUSH_NULL
70: 1586 LOAD_GLOBAL (ast)
1596 LOAD_ATTR (Name)
1616 PUSH_NULL
1618 LOAD_CONST ("o0oL")
1620 LOAD_GLOBAL (ast)
1630 LOAD_ATTR (Store)
1650 PUSH_NULL
1652 CALL 0
1660 LOAD_CONST (('id', 'ctx'))
1662 CALL_KW 2
1664 BUILD_LIST 1
71: 1666 LOAD_GLOBAL (ast)
1676 LOAD_ATTR (BinOp)
1696 PUSH_NULL
72: 1698 LOAD_GLOBAL (ast)
1708 LOAD_ATTR (BinOp)
1728 PUSH_NULL
73: 1730 LOAD_GLOBAL (ast)
1740 LOAD_ATTR (BinOp)
1760 PUSH_NULL
1762 LOAD_GLOBAL (ast)
1772 LOAD_ATTR (Name)
1792 PUSH_NULL
1794 LOAD_CONST ("o0oE")
1796 LOAD_GLOBAL (ast)
1806 LOAD_ATTR (Load)
1826 PUSH_NULL
1828 CALL 0
1836 LOAD_CONST (('id', 'ctx'))
1838 CALL_KW 2
1840 LOAD_GLOBAL (ast)
1850 LOAD_ATTR (RShift)
1870 PUSH_NULL
1872 CALL 0
1880 LOAD_GLOBAL (ast)
1890 LOAD_ATTR (Constant)
1910 PUSH_NULL
1912 LOAD_CONST (8)
1914 CALL 1
1922 CALL 3
74: 1930 LOAD_GLOBAL (ast)
1940 LOAD_ATTR (BitXor)
1960 PUSH_NULL
1962 CALL 0
75: 1970 LOAD_GLOBAL (ast)
1980 LOAD_ATTR (Name)
2000 PUSH_NULL
2002 LOAD_CONST ("o0oF")
2004 LOAD_GLOBAL (ast)
2014 LOAD_ATTR (Load)
2034 PUSH_NULL
2036 CALL 0
2044 LOAD_CONST (('id', 'ctx'))
2046 CALL_KW 2
72: 2048 CALL 3
77: 2056 LOAD_GLOBAL (ast)
2066 LOAD_ATTR (BitAnd)
2086 PUSH_NULL
2088 CALL 0
78: 2096 LOAD_GLOBAL (ast)
2106 LOAD_ATTR (Constant)
2126 PUSH_NULL
2128 LOAD_CONST (65535)
2130 CALL 1
71: 2138 CALL 3
69: 2146 LOAD_CONST (('targets', 'value'))
2148 CALL_KW 2
2150 CALL 1
2158 POP_TOP
82: 2160 LOAD_FAST (o0oG)
2162 LOAD_ATTR (NULL|self + append)
2182 LOAD_GLOBAL (ast)
2192 LOAD_ATTR (Assign)
2212 PUSH_NULL
83: 2214 LOAD_GLOBAL (ast)
2224 LOAD_ATTR (Name)
2244 PUSH_NULL
2246 LOAD_CONST ("o0oM")
2248 LOAD_GLOBAL (ast)
2258 LOAD_ATTR (Store)
2278 PUSH_NULL
2280 CALL 0
2288 LOAD_CONST (('id', 'ctx'))
2290 CALL_KW 2
2292 BUILD_LIST 1
84: 2294 LOAD_GLOBAL (ast)
2304 LOAD_ATTR (BinOp)
2324 PUSH_NULL
85: 2326 LOAD_GLOBAL (ast)
2336 LOAD_ATTR (BinOp)
2356 PUSH_NULL
86: 2358 LOAD_GLOBAL (ast)
2368 LOAD_ATTR (Name)
2388 PUSH_NULL
2390 LOAD_CONST ("o0oH")
2392 LOAD_GLOBAL (ast)
2402 LOAD_ATTR (Load)
2422 PUSH_NULL
2424 CALL 0
2432 LOAD_CONST (('id', 'ctx'))
2434 CALL_KW 2
87: 2436 LOAD_GLOBAL (ast)
2446 LOAD_ATTR (Mult)
2466 PUSH_NULL
2468 CALL 0
88: 2476 LOAD_GLOBAL (ast)
2486 LOAD_ATTR (BinOp)
2506 PUSH_NULL
2508 LOAD_GLOBAL (ast)
2518 LOAD_ATTR (Name)
2538 PUSH_NULL
2540 LOAD_CONST ("o0oF")
2542 LOAD_GLOBAL (ast)
2552 LOAD_ATTR (Load)
2572 PUSH_NULL
2574 CALL 0
2582 LOAD_CONST (('id', 'ctx'))
2584 CALL_KW 2
2586 LOAD_GLOBAL (ast)
2596 LOAD_ATTR (Add)
2616 PUSH_NULL
2618 CALL 0
2626 LOAD_GLOBAL (ast)
2636 LOAD_ATTR (Constant)
2656 PUSH_NULL
2658 LOAD_CONST (1)
2660 CALL 1
2668 CALL 3
85: 2676 CALL 3
90: 2684 LOAD_GLOBAL (ast)
2694 LOAD_ATTR (BitAnd)
2714 PUSH_NULL
2716 CALL 0
91: 2724 LOAD_GLOBAL (ast)
2734 LOAD_ATTR (Constant)
2754 PUSH_NULL
2756 LOAD_CONST (4294967295L)
2758 CALL 1
84: 2766 CALL 3
82: 2774 LOAD_CONST (('targets', 'value'))
2776 CALL_KW 2
2778 CALL 1
2786 POP_TOP
95: 2788 LOAD_FAST (o0oG)
2790 LOAD_ATTR (NULL|self + append)
2810 LOAD_GLOBAL (ast)
2820 LOAD_ATTR (Assign)
2840 PUSH_NULL
96: 2842 LOAD_GLOBAL (ast)
2852 LOAD_ATTR (Name)
2872 PUSH_NULL
2874 LOAD_CONST ("o0oN")
2876 LOAD_GLOBAL (ast)
2886 LOAD_ATTR (Store)
2906 PUSH_NULL
2908 CALL 0
2916 LOAD_CONST (('id', 'ctx'))
2918 CALL_KW 2
2920 BUILD_LIST 1
97: 2922 LOAD_GLOBAL (ast)
2932 LOAD_ATTR (BinOp)
2952 PUSH_NULL
98: 2954 LOAD_GLOBAL (ast)
2964 LOAD_ATTR (BinOp)
2984 PUSH_NULL
99: 2986 LOAD_GLOBAL (ast)
2996 LOAD_ATTR (BinOp)
3016 PUSH_NULL
100: 3018 LOAD_GLOBAL (ast)
3028 LOAD_ATTR (BinOp)
3048 PUSH_NULL
3050 LOAD_GLOBAL (ast)
3060 LOAD_ATTR (Name)
3080 PUSH_NULL
3082 LOAD_CONST ("o0oD")
3084 LOAD_GLOBAL (ast)
3094 LOAD_ATTR (Load)
3114 PUSH_NULL
3116 CALL 0
3124 LOAD_CONST (('id', 'ctx'))
3126 CALL_KW 2
3128 LOAD_GLOBAL (ast)
3138 LOAD_ATTR (LShift)
3158 PUSH_NULL
3160 CALL 0
3168 LOAD_GLOBAL (ast)
3178 LOAD_ATTR (Constant)
3198 PUSH_NULL
3200 LOAD_CONST (5)
3202 CALL 1
3210 CALL 3
101: 3218 LOAD_GLOBAL (ast)
3228 LOAD_ATTR (Add)
3248 PUSH_NULL
3250 CALL 0
102: 3258 LOAD_GLOBAL (ast)
3268 LOAD_ATTR (Name)
3288 PUSH_NULL
3290 LOAD_CONST ("o0oI")
3292 LOAD_GLOBAL (ast)
3302 LOAD_ATTR (Load)
3322 PUSH_NULL
3324 CALL 0
3332 LOAD_CONST (('id', 'ctx'))
3334 CALL_KW 2
99: 3336 CALL 3
104: 3344 LOAD_GLOBAL (ast)
3354 LOAD_ATTR (BitXor)
3374 PUSH_NULL
3376 CALL 0
105: 3384 LOAD_GLOBAL (ast)
3394 LOAD_ATTR (BinOp)
3414 PUSH_NULL
3416 LOAD_GLOBAL (ast)
3426 LOAD_ATTR (Name)
3446 PUSH_NULL
3448 LOAD_CONST ("o0oD")
3450 LOAD_GLOBAL (ast)
3460 LOAD_ATTR (Load)
3480 PUSH_NULL
3482 CALL 0
3490 LOAD_CONST (('id', 'ctx'))
3492 CALL_KW 2
3494 LOAD_GLOBAL (ast)
3504 LOAD_ATTR (Add)
3524 PUSH_NULL
3526 CALL 0
3534 LOAD_GLOBAL (ast)
3544 LOAD_ATTR (Name)
3564 PUSH_NULL
3566 LOAD_CONST ("o0oM")
3568 LOAD_GLOBAL (ast)
3578 LOAD_ATTR (Load)
3598 PUSH_NULL
3600 CALL 0
3608 LOAD_CONST (('id', 'ctx'))
3610 CALL_KW 2
3612 CALL 3
98: 3620 CALL 3
107: 3628 LOAD_GLOBAL (ast)
3638 LOAD_ATTR (BitXor)
3658 PUSH_NULL
3660 CALL 0
108: 3668 LOAD_GLOBAL (ast)
3678 LOAD_ATTR (BinOp)
3698 PUSH_NULL
109: 3700 LOAD_GLOBAL (ast)
3710 LOAD_ATTR (BinOp)
3730 PUSH_NULL
3732 LOAD_GLOBAL (ast)
3742 LOAD_ATTR (Name)
3762 PUSH_NULL
3764 LOAD_CONST ("o0oD")
3766 LOAD_GLOBAL (ast)
3776 LOAD_ATTR (Load)
3796 PUSH_NULL
3798 CALL 0
3806 LOAD_CONST (('id', 'ctx'))
3808 CALL_KW 2
3810 LOAD_GLOBAL (ast)
3820 LOAD_ATTR (RShift)
3840 PUSH_NULL
3842 CALL 0
3850 LOAD_GLOBAL (ast)
3860 LOAD_ATTR (Constant)
3880 PUSH_NULL
3882 LOAD_CONST (5)
3884 CALL 1
3892 CALL 3
110: 3900 LOAD_GLOBAL (ast)
3910 LOAD_ATTR (Add)
3930 PUSH_NULL
3932 CALL 0
111: 3940 LOAD_GLOBAL (ast)
3950 LOAD_ATTR (Name)
3970 PUSH_NULL
3972 LOAD_CONST ("o0oJ")
3974 LOAD_GLOBAL (ast)
3984 LOAD_ATTR (Load)
4004 PUSH_NULL
4006 CALL 0
4014 LOAD_CONST (('id', 'ctx'))
4016 CALL_KW 2
108: 4018 CALL 3
97: 4026 CALL 3
95: 4034 LOAD_CONST (('targets', 'value'))
4036 CALL_KW 2
4038 CALL 1
4046 POP_TOP
116: 4048 LOAD_FAST (o0oG)
4050 LOAD_ATTR (NULL|self + append)
4070 LOAD_GLOBAL (ast)
4080 LOAD_ATTR (Assign)
4100 PUSH_NULL
117: 4102 LOAD_GLOBAL (ast)
4112 LOAD_ATTR (Name)
4132 PUSH_NULL
4134 LOAD_CONST ("o0oP")
4136 LOAD_GLOBAL (ast)
4146 LOAD_ATTR (Store)
4166 PUSH_NULL
4168 CALL 0
4176 LOAD_CONST (('id', 'ctx'))
4178 CALL_KW 2
4180 BUILD_LIST 1
118: 4182 LOAD_GLOBAL (ast)
4192 LOAD_ATTR (BinOp)
4212 PUSH_NULL
119: 4214 LOAD_GLOBAL (ast)
4224 LOAD_ATTR (BinOp)
4244 PUSH_NULL
4246 LOAD_GLOBAL (ast)
4256 LOAD_ATTR (Name)
4276 PUSH_NULL
4278 LOAD_CONST ("o0oC")
4280 LOAD_GLOBAL (ast)
4290 LOAD_ATTR (Load)
4310 PUSH_NULL
4312 CALL 0
4320 LOAD_CONST (('id', 'ctx'))
4322 CALL_KW 2
4324 LOAD_GLOBAL (ast)
4334 LOAD_ATTR (Add)
4354 PUSH_NULL
4356 CALL 0
4364 LOAD_GLOBAL (ast)
4374 LOAD_ATTR (Name)
4394 PUSH_NULL
4396 LOAD_CONST ("o0oN")
4398 LOAD_GLOBAL (ast)
4408 LOAD_ATTR (Load)
4428 PUSH_NULL
4430 CALL 0
4438 LOAD_CONST (('id', 'ctx'))
4440 CALL_KW 2
4442 CALL 3
120: 4450 LOAD_GLOBAL (ast)
4460 LOAD_ATTR (BitAnd)
4480 PUSH_NULL
4482 CALL 0
121: 4490 LOAD_GLOBAL (ast)
4500 LOAD_ATTR (Constant)
4520 PUSH_NULL
4522 LOAD_CONST (65535)
4524 CALL 1
118: 4532 CALL 3
116: 4540 LOAD_CONST (('targets', 'value'))
4542 CALL_KW 2
4544 CALL 1
4552 POP_TOP
125: 4554 LOAD_FAST (o0oG)
4556 LOAD_ATTR (NULL|self + append)
4576 LOAD_GLOBAL (ast)
4586 LOAD_ATTR (Assign)
4606 PUSH_NULL
126: 4608 LOAD_GLOBAL (ast)
4618 LOAD_ATTR (Name)
4638 PUSH_NULL
4640 LOAD_CONST ("o0oN")
4642 LOAD_GLOBAL (ast)
4652 LOAD_ATTR (Store)
4672 PUSH_NULL
4674 CALL 0
4682 LOAD_CONST (('id', 'ctx'))
4684 CALL_KW 2
4686 BUILD_LIST 1
127: 4688 LOAD_GLOBAL (ast)
4698 LOAD_ATTR (BinOp)
4718 PUSH_NULL
128: 4720 LOAD_GLOBAL (ast)
4730 LOAD_ATTR (BinOp)
4750 PUSH_NULL
129: 4752 LOAD_GLOBAL (ast)
4762 LOAD_ATTR (BinOp)
4782 PUSH_NULL
130: 4784 LOAD_GLOBAL (ast)
4794 LOAD_ATTR (BinOp)
4814 PUSH_NULL
4816 LOAD_GLOBAL (ast)
4826 LOAD_ATTR (Name)
4846 PUSH_NULL
4848 LOAD_CONST ("o0oP")
4850 LOAD_GLOBAL (ast)
4860 LOAD_ATTR (Load)
4880 PUSH_NULL
4882 CALL 0
4890 LOAD_CONST (('id', 'ctx'))
4892 CALL_KW 2
4894 LOAD_GLOBAL (ast)
4904 LOAD_ATTR (LShift)
4924 PUSH_NULL
4926 CALL 0
4934 LOAD_GLOBAL (ast)
4944 LOAD_ATTR (Constant)
4964 PUSH_NULL
4966 LOAD_CONST (5)
4968 CALL 1
4976 CALL 3
131: 4984 LOAD_GLOBAL (ast)
4994 LOAD_ATTR (Add)
5014 PUSH_NULL
5016 CALL 0
132: 5024 LOAD_GLOBAL (ast)
5034 LOAD_ATTR (Name)
5054 PUSH_NULL
5056 LOAD_CONST ("o0oK")
5058 LOAD_GLOBAL (ast)
5068 LOAD_ATTR (Load)
5088 PUSH_NULL
5090 CALL 0
5098 LOAD_CONST (('id', 'ctx'))
5100 CALL_KW 2
129: 5102 CALL 3
134: 5110 LOAD_GLOBAL (ast)
5120 LOAD_ATTR (BitXor)
5140 PUSH_NULL
5142 CALL 0
135: 5150 LOAD_GLOBAL (ast)
5160 LOAD_ATTR (BinOp)
5180 PUSH_NULL
5182 LOAD_GLOBAL (ast)
5192 LOAD_ATTR (Name)
5212 PUSH_NULL
5214 LOAD_CONST ("o0oP")
5216 LOAD_GLOBAL (ast)
5226 LOAD_ATTR (Load)
5246 PUSH_NULL
5248 CALL 0
5256 LOAD_CONST (('id', 'ctx'))
5258 CALL_KW 2
5260 LOAD_GLOBAL (ast)
5270 LOAD_ATTR (Add)
5290 PUSH_NULL
5292 CALL 0
5300 LOAD_GLOBAL (ast)
5310 LOAD_ATTR (Name)
5330 PUSH_NULL
5332 LOAD_CONST ("o0oM")
5334 LOAD_GLOBAL (ast)
5344 LOAD_ATTR (Load)
5364 PUSH_NULL
5366 CALL 0
5374 LOAD_CONST (('id', 'ctx'))
5376 CALL_KW 2
5378 CALL 3
128: 5386 CALL 3
137: 5394 LOAD_GLOBAL (ast)
5404 LOAD_ATTR (BitXor)
5424 PUSH_NULL
5426 CALL 0
138: 5434 LOAD_GLOBAL (ast)
5444 LOAD_ATTR (BinOp)
5464 PUSH_NULL
139: 5466 LOAD_GLOBAL (ast)
5476 LOAD_ATTR (BinOp)
5496 PUSH_NULL
5498 LOAD_GLOBAL (ast)
5508 LOAD_ATTR (Name)
5528 PUSH_NULL
5530 LOAD_CONST ("o0oP")
5532 LOAD_GLOBAL (ast)
5542 LOAD_ATTR (Load)
5562 PUSH_NULL
5564 CALL 0
5572 LOAD_CONST (('id', 'ctx'))
5574 CALL_KW 2
5576 LOAD_GLOBAL (ast)
5586 LOAD_ATTR (RShift)
5606 PUSH_NULL
5608 CALL 0
5616 LOAD_GLOBAL (ast)
5626 LOAD_ATTR (Constant)
5646 PUSH_NULL
5648 LOAD_CONST (5)
5650 CALL 1
5658 CALL 3
140: 5666 LOAD_GLOBAL (ast)
5676 LOAD_ATTR (Add)
5696 PUSH_NULL
5698 CALL 0
141: 5706 LOAD_GLOBAL (ast)
5716 LOAD_ATTR (Name)
5736 PUSH_NULL
5738 LOAD_CONST ("o0oL")
5740 LOAD_GLOBAL (ast)
5750 LOAD_ATTR (Load)
5770 PUSH_NULL
5772 CALL 0
5780 LOAD_CONST (('id', 'ctx'))
5782 CALL_KW 2
138: 5784 CALL 3
127: 5792 CALL 3
125: 5800 LOAD_CONST (('targets', 'value'))
5802 CALL_KW 2
5804 CALL 1
5812 POP_TOP
146: 5814 LOAD_FAST (o0oG)
5816 LOAD_ATTR (NULL|self + append)
5836 LOAD_GLOBAL (ast)
5846 LOAD_ATTR (Assign)
5866 PUSH_NULL
147: 5868 LOAD_GLOBAL (ast)
5878 LOAD_ATTR (Name)
5898 PUSH_NULL
5900 LOAD_CONST ("o0oQ")
5902 LOAD_GLOBAL (ast)
5912 LOAD_ATTR (Store)
5932 PUSH_NULL
5934 CALL 0
5942 LOAD_CONST (('id', 'ctx'))
5944 CALL_KW 2
5946 BUILD_LIST 1
148: 5948 LOAD_GLOBAL (ast)
5958 LOAD_ATTR (BinOp)
5978 PUSH_NULL
149: 5980 LOAD_GLOBAL (ast)
5990 LOAD_ATTR (BinOp)
6010 PUSH_NULL
6012 LOAD_GLOBAL (ast)
6022 LOAD_ATTR (Name)
6042 PUSH_NULL
6044 LOAD_CONST ("o0oD")
6046 LOAD_GLOBAL (ast)
6056 LOAD_ATTR (Load)
6076 PUSH_NULL
6078 CALL 0
6086 LOAD_CONST (('id', 'ctx'))
6088 CALL_KW 2
6090 LOAD_GLOBAL (ast)
6100 LOAD_ATTR (Add)
6120 PUSH_NULL
6122 CALL 0
6130 LOAD_GLOBAL (ast)
6140 LOAD_ATTR (Name)
6160 PUSH_NULL
6162 LOAD_CONST ("o0oN")
6164 LOAD_GLOBAL (ast)
6174 LOAD_ATTR (Load)
6194 PUSH_NULL
6196 CALL 0
6204 LOAD_CONST (('id', 'ctx'))
6206 CALL_KW 2
6208 CALL 3
150: 6216 LOAD_GLOBAL (ast)
6226 LOAD_ATTR (BitAnd)
6246 PUSH_NULL
6248 CALL 0
151: 6256 LOAD_GLOBAL (ast)
6266 LOAD_ATTR (Constant)
6286 PUSH_NULL
6288 LOAD_CONST (65535)
6290 CALL 1
148: 6298 CALL 3
146: 6306 LOAD_CONST (('targets', 'value'))
6308 CALL_KW 2
6310 CALL 1
6318 POP_TOP
155: 6320 LOAD_FAST (o0oG)
6322 LOAD_ATTR (NULL|self + append)
6342 LOAD_GLOBAL (ast)
6352 LOAD_ATTR (Return)
6372 PUSH_NULL
156: 6374 LOAD_GLOBAL (ast)
6384 LOAD_ATTR (Tuple)
6404 PUSH_NULL
157: 6406 LOAD_GLOBAL (ast)
6416 LOAD_ATTR (Name)
6436 PUSH_NULL
6438 LOAD_CONST ("o0oP")
6440 LOAD_GLOBAL (ast)
6450 LOAD_ATTR (Load)
6470 PUSH_NULL
6472 CALL 0
6480 LOAD_CONST (('id', 'ctx'))
6482 CALL_KW 2
6484 LOAD_GLOBAL (ast)
6494 LOAD_ATTR (Name)
6514 PUSH_NULL
6516 LOAD_CONST ("o0oQ")
6518 LOAD_GLOBAL (ast)
6528 LOAD_ATTR (Load)
6548 PUSH_NULL
6550 CALL 0
6558 LOAD_CONST (('id', 'ctx'))
6560 CALL_KW 2
6562 BUILD_LIST 2
158: 6564 LOAD_GLOBAL (ast)
6574 LOAD_ATTR (Load)
6594 PUSH_NULL
6596 CALL 0
156: 6604 LOAD_CONST (('elts', 'ctx'))
6606 CALL_KW 2
155: 6608 CALL 1
6616 CALL 1
6624 POP_TOP
162: 6626 LOAD_GLOBAL (ast)
6636 LOAD_ATTR (FunctionDef)
6656 PUSH_NULL
163: 6658 LOAD_FAST (o0oA)
164: 6660 LOAD_GLOBAL (ast)
6670 LOAD_ATTR (arguments)
6690 PUSH_NULL
165: 6692 BUILD_LIST 0
166: 6694 LOAD_FAST (o0oB)
6696 GET_ITER
6698 LOAD_FAST_AND_CLEAR (a)
6700 SWAP 2
6702 BUILD_LIST 0
6704 SWAP 2
6706 GET_ITER
6708 FOR_ITER (to 6758)
6712 STORE_FAST (a)
6714 LOAD_GLOBAL (ast)
6724 LOAD_ATTR (arg)
6744 PUSH_NULL
6746 LOAD_FAST (a)
6748 LOAD_CONST (('arg',))
6750 CALL_KW 1
6752 LIST_APPEND 2
6754 JUMP_BACKWARD (to 6708)
>> 6758 END_FOR
6760 POP_TOP
6762 SWAP 2
6764 STORE_FAST (a)
167: 6766 BUILD_LIST 0
168: 6768 BUILD_LIST 0
169: 6770 BUILD_LIST 0
164: 6772 LOAD_CONST (('posonlyargs', 'args', 'kwonlyargs', 'kw_defaults', 'defaults'))
6774 CALL_KW 5
171: 6776 LOAD_FAST (o0oG)
172: 6778 BUILD_LIST 0
162: 6780 LOAD_CONST (('name', 'args', 'body', 'decorator_list'))
6782 CALL_KW 4
6784 STORE_FAST (o0oU)
175: 6786 LOAD_GLOBAL (ast)
6796 LOAD_ATTR (parse)
6816 PUSH_NULL
6818 LOAD_CONST ("\ndef _tea_helper_func(a, b, c):\n magic1 = (a ^ b) & 0xDEADBEEF\n magic2 = (c << 3) | (a >> 5)\n return (magic1 + magic2 - (b & 0xCAFEBABE)) & 0xFFFFFFFF\n\ndef _fake_tea_round(x, y):\n return ((x * 0x9E3779B9) ^ (y + 0x12345678)) & 0xFFFFFFFF\n\n_tea_magic_delta = 0x9E3779B9 ^ 0x12345678\n_tea_dummy_keys = [0x1111, 0x2222, 0x3333, 0x4444]\n")
6820 CALL 1
186: 6828 LOAD_ATTR (body)
175: 6848 STORE_FAST (o0oV)
188: 6850 LOAD_GLOBAL (ast)
6860 LOAD_ATTR (Module)
6880 PUSH_NULL
6882 LOAD_FAST (o0oU)
6884 BUILD_LIST 1
6886 LOAD_FAST (o0oV)
6888 BINARY_OP (+)
6892 BUILD_LIST 0
6894 LOAD_CONST (('body', 'type_ignores'))
6896 CALL_KW 2
6898 STORE_FAST (o0oW)
189: 6900 LOAD_GLOBAL (ast)
6910 LOAD_ATTR (fix_missing_locations)
6930 PUSH_NULL
6932 LOAD_FAST (o0oW)
6934 CALL 1
6942 POP_TOP
192: 6944 LOAD_GLOBAL (NULL + compile)
6954 LOAD_FAST (o0oW)
6956 LOAD_CONST ("<tea_obf_ast>")
6958 LOAD_CONST ("exec")
6960 LOAD_CONST (('filename', 'mode'))
6962 CALL_KW 3
6964 STORE_FAST (o0oX)
193: 6966 BUILD_MAP 0
6968 STORE_FAST (o0oY)
194: 6970 LOAD_GLOBAL (NULL + exec)
6980 LOAD_FAST_LOAD_FAST (o0oX, o0oY)
6982 CALL 2
6990 POP_TOP
197: 6992 LOAD_FAST_LOAD_FAST (o0oA, o0oY)
6994 CONTAINS_OP (in)
6998 POP_JUMP_IF_FALSE (to 7016)
198: 7002 LOAD_FAST_LOAD_FAST (o0oY, o0oA)
7004 BINARY_SUBSCR
7008 LOAD_FAST_LOAD_FAST (o0o0o17, o0oA)
7010 STORE_SUBSCR
7014 RETURN_CONST (None)
197: >> 7016 RETURN_CONST (None)
>> 7018 SWAP 2
7020 POP_TOP
166: 7022 SWAP 2
7024 STORE_FAST (a)
7026 RERAISE 0
ExceptionTable:
6702 to 6760 -> 7018 [8]
# Method Name: shouan
# Filename: key.py
# Argument count: 1
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 12
# Stack size: 7
# Flags: 0x00000003 (NEWLOCALS | OPTIMIZED)
# First Line: 202
# Constants:
# 0: None
# 1: 9
# 2: '需要输入9个key'
# 3: 2025
# 4: 8
# 5: 1
# Names:
# 0: len
# 1: ValueError
# 2: enumerate
# 3: Shorekeeper
# 4: Carlotta
# 5: Kathysia
# 6: append
# 7: range
# 8: changli
# Varnames:
# o0o0o32, o0o0o35, o0o0o49, o0o0o34, o0o0o33, o0o0o36, o0o0o37, o0o0o38, o0o0o39, o0o0o40, o0o0o41, i
# Positional arguments:
# o0o0o32
# Local variables:
# 1: o0o0o35
# 2: o0o0o49
# 3: o0o0o34
# 4: o0o0o33
# 5: o0o0o36
# 6: o0o0o37
# 7: o0o0o38
# 8: o0o0o39
# 9: o0o0o40
# 10: o0o0o41
# 11: i
202: 0 RESUME 0
204: 2 LOAD_GLOBAL (NULL + len)
12 LOAD_FAST (o0o0o32)
14 CALL 1
22 LOAD_CONST (9)
24 COMPARE_OP (!=)
28 POP_JUMP_IF_FALSE (to 54)
205: 32 LOAD_GLOBAL (NULL + ValueError)
42 LOAD_CONST ("需要输入9个key")
44 CALL 1
52 RAISE_VARARGS (exception instance)
207: >> 54 BUILD_LIST 0
56 STORE_FAST (o0o0o35)
208: 58 LOAD_GLOBAL (NULL + enumerate)
68 LOAD_FAST (o0o0o32)
70 CALL 1
78 GET_ITER
80 FOR_ITER (to 220)
84 UNPACK_SEQUENCE 2
88 STORE_FAST_STORE_FAST (o0o0o49, o0o0o34)
209: 90 LOAD_FAST_LOAD_FAST (o0o0o49, o0o0o49)
92 BINARY_OP (*)
96 STORE_FAST (o0o0o33)
210: 98 LOAD_GLOBAL (NULL + Shorekeeper)
108 LOAD_FAST (o0o0o34)
110 CALL 1
118 UNPACK_SEQUENCE 2
122 STORE_FAST_STORE_FAST (o0o0o36, o0o0o37)
211: 124 LOAD_GLOBAL (NULL + Carlotta)
134 LOAD_FAST_LOAD_FAST (o0o0o36, o0o0o37)
136 LOAD_FAST (o0o0o49)
138 LOAD_CONST (2025)
140 BINARY_OP (+)
144 LOAD_FAST (o0o0o33)
146 CALL 4
154 UNPACK_SEQUENCE 2
158 STORE_FAST_STORE_FAST (o0o0o38, o0o0o39)
212: 160 LOAD_GLOBAL (NULL + Kathysia)
170 LOAD_FAST_LOAD_FAST (o0o0o38, o0o0o39)
172 CALL 2
180 STORE_FAST (o0o0o40)
213: 182 LOAD_FAST (o0o0o35)
184 LOAD_ATTR (NULL|self + append)
204 LOAD_FAST (o0o0o40)
206 CALL 1
214 POP_TOP
216 JUMP_BACKWARD (to 80)
208: >> 220 END_FOR
222 POP_TOP
215: 224 BUILD_LIST 0
226 STORE_FAST (o0o0o41)
216: 228 LOAD_GLOBAL (NULL + range)
238 LOAD_CONST (8)
240 CALL 1
248 GET_ITER
250 FOR_ITER (to 358)
254 STORE_FAST (i)
217: 256 LOAD_GLOBAL (NULL + changli)
266 LOAD_FAST_LOAD_FAST (o0o0o35, i)
268 BINARY_SUBSCR
272 LOAD_FAST_LOAD_FAST (o0o0o35, i)
274 LOAD_CONST (1)
276 BINARY_OP (+)
280 BINARY_SUBSCR
284 LOAD_CONST (2025)
286 CALL 3
294 UNPACK_SEQUENCE 2
298 LOAD_FAST_LOAD_FAST (o0o0o35, i)
300 STORE_SUBSCR
304 LOAD_FAST_LOAD_FAST (o0o0o35, i)
306 LOAD_CONST (1)
308 BINARY_OP (+)
312 STORE_SUBSCR
218: 316 LOAD_FAST (o0o0o41)
318 LOAD_ATTR (NULL|self + append)
338 LOAD_FAST_LOAD_FAST (o0o0o35, i)
340 BINARY_SUBSCR
344 CALL 1
352 POP_TOP
354 JUMP_BACKWARD (to 250)
216: >> 358 END_FOR
>> 360 POP_TOP
219: 362 LOAD_FAST (o0o0o41)
364 LOAD_ATTR (NULL|self + append)
384 LOAD_FAST (o0o0o35)
386 LOAD_CONST (8)
388 BINARY_SUBSCR
392 CALL 1
400 POP_TOP
220: 402 LOAD_FAST (o0o0o41)
404 RETURN_VALUE
# Method Name: jinhsi
# Filename: key.py
# Argument count: 0
# Position-only argument count: 0
# Keyword-only arguments: 0
# Number of locals: 7
# Stack size: 7
# Flags: 0x00000003 (NEWLOCALS | OPTIMIZED)
# First Line: 222
# Constants:
# 0: None
# 1: '请输入9个数字:'
# 2: ','
# 3: 9
# 4: '错误: 需要输入9个数'
# 5: "错误: '"
# 6: "' 不是有效的整数"
# 7: '正确!这是真正的key'
# 8: 0
# 9: '错误!这不是正确的key'
# 10: '你的结果: '
# 11: '发生错误: '
# Names:
# 0: print
# 1: input
# 2: strip
# 3: split
# 4: len
# 5: int
# 6: append
# 7: ValueError
# 8: shouan
# 9: o0o0o0
# 10: sys
# 11: exit
# 12: Exception
# Varnames:
# o0o0o46, o0o0o42, o0o0o43, o0o0o44, o0o0o45, o0o0o48, o0o0o47
# Local variables:
# 0: o0o0o46
# 1: o0o0o42
# 2: o0o0o43
# 3: o0o0o44
# 4: o0o0o45
# 5: o0o0o48
# 6: o0o0o47
222: 0 RESUME 0
223: 2 LOAD_GLOBAL (NULL + print)
12 LOAD_CONST ("请输入9个数字:")
14 CALL 1
22 POP_TOP
224: 24 NOP
225: 26 LOAD_GLOBAL (NULL + input)
36 CALL 0
44 LOAD_ATTR (NULL|self + strip)
64 CALL 0
72 STORE_FAST (o0o0o46)
227: 74 LOAD_CONST (",")
76 LOAD_FAST (o0o0o46)
78 CONTAINS_OP (in)
82 POP_JUMP_IF_FALSE (to 122)
228: 86 LOAD_FAST (o0o0o46)
88 LOAD_ATTR (NULL|self + split)
108 LOAD_CONST (",")
110 CALL 1
118 STORE_FAST (o0o0o42)
120 JUMP_FORWARD (to 154)
230: >> 122 LOAD_FAST (o0o0o46)
124 LOAD_ATTR (NULL|self + split)
144 CALL 0
152 STORE_FAST (o0o0o42)
232: >> 154 LOAD_GLOBAL (NULL + len)
164 LOAD_FAST (o0o0o42)
166 CALL 1
174 LOAD_CONST (9)
176 COMPARE_OP (!=)
180 POP_JUMP_IF_FALSE (to 208)
233: 184 LOAD_GLOBAL (NULL + print)
194 LOAD_CONST ("错误: 需要输入9个数")
196 CALL 1
204 POP_TOP
234: 206 RETURN_CONST (None)
235: >> 208 BUILD_LIST 0
210 STORE_FAST (o0o0o43)
236: 212 LOAD_FAST (o0o0o42)
214 GET_ITER
216 FOR_ITER (to 312)
220 STORE_FAST (o0o0o44)
237: 222 NOP
238: 224 LOAD_GLOBAL (NULL + int)
234 LOAD_FAST (o0o0o44)
236 LOAD_ATTR (NULL|self + strip)
256 CALL 0
264 CALL 1
272 STORE_FAST (o0o0o45)
239: 274 LOAD_FAST (o0o0o43)
276 LOAD_ATTR (NULL|self + append)
296 LOAD_FAST (o0o0o45)
298 CALL 1
306 POP_TOP
308 JUMP_BACKWARD (to 216)
236: >> 312 END_FOR
314 POP_TOP
244: 316 LOAD_GLOBAL (NULL + shouan)
326 LOAD_FAST (o0o0o43)
328 CALL 1
336 STORE_FAST (o0o0o48)
246: 338 LOAD_FAST (o0o0o48)
340 LOAD_GLOBAL (o0o0o0)
350 COMPARE_OP (==)
354 POP_JUMP_IF_FALSE (to 426)
247: 358 LOAD_GLOBAL (NULL + print)
368 LOAD_CONST ("正确!这是真正的key")
370 CALL 1
378 POP_TOP
248: 380 LOAD_GLOBAL (sys)
390 LOAD_ATTR (exit)
410 PUSH_NULL
412 LOAD_CONST (0)
414 CALL 1
422 POP_TOP
424 RETURN_CONST (None)
250: >> 426 LOAD_GLOBAL (NULL + print)
436 LOAD_CONST ("错误!这不是正确的key")
438 CALL 1
446 POP_TOP
251: 448 LOAD_GLOBAL (NULL + print)
458 LOAD_CONST ("你的结果: ")
460 LOAD_FAST (o0o0o48)
462 FORMAT_SIMPLE
464 BUILD_STRING 2
466 CALL 1
474 POP_TOP
252: 476 LOAD_GLOBAL (sys)
486 LOAD_ATTR (exit)
506 PUSH_NULL
508 LOAD_CONST (0)
510 CALL 1
518 POP_TOP
520 RETURN_CONST (None)
>> 522 PUSH_EXC_INFO
240: 524 LOAD_GLOBAL (ValueError)
534 CHECK_EXC_MATCH
536 POP_JUMP_IF_FALSE (to 578)
540 POP_TOP
241: 542 LOAD_GLOBAL (NULL + print)
552 LOAD_CONST ("错误: '")
554 LOAD_FAST (o0o0o44)
556 FORMAT_SIMPLE
558 LOAD_CONST ("' 不是有效的整数")
560 BUILD_STRING 3
562 CALL 1
570 POP_TOP
242: 572 POP_EXCEPT
574 POP_TOP
576 RETURN_CONST (None)
240: >> 578 RERAISE 0
>> 580 COPY 3
582 POP_EXCEPT
584 RERAISE 1
>> 586 PUSH_EXC_INFO
254: 588 LOAD_GLOBAL (Exception)
598 CHECK_EXC_MATCH
600 POP_JUMP_IF_FALSE (to 652)
604 STORE_FAST (o0o0o47)
255: 606 LOAD_GLOBAL (NULL + print)
616 LOAD_CONST ("发生错误: ")
618 LOAD_FAST (o0o0o47)
620 FORMAT_SIMPLE
622 BUILD_STRING 2
624 CALL 1
632 POP_TOP
634 POP_EXCEPT
636 LOAD_CONST (None)
638 STORE_FAST (o0o0o47)
640 DELETE_FAST (o0o0o47)
642 RETURN_CONST (None)
>> 644 LOAD_CONST (None)
646 STORE_FAST (o0o0o47)
648 DELETE_FAST (o0o0o47)
650 RERAISE 1
254: >> 652 RERAISE 0
>> 654 COPY 3
656 POP_EXCEPT
658 RERAISE 1
ExceptionTable:
26 to 204 -> 586 [0]
208 to 220 -> 586 [0]
224 to 306 -> 522 [1]
308 to 422 -> 586 [0]
426 to 518 -> 586 [0]
522 to 570 -> 580 [2] lasti
572 to 574 -> 586 [0]
578 to 578 -> 580 [2] lasti
580 to 584 -> 586 [0]
586 to 604 -> 654 [1] lasti
606 to 632 -> 644 [1] lasti
644 to 652 -> 654 [1] lasti
然后把这两坨都丢给ai
gpt和claude都没干出来
deepseek干出来了
def changli_inv(L, R, o0o0o3):
# 逆向changli函数
o0o0o4 = 2269471011
o0o0o5 = o0o0o3 & 0xFFFFFFFF
o0o0o6 = ((o0o0o3 >> 8) ^ 305419896) & 0xFFFFFFFF
o0o0o7 = ((o0o0o3 << 4) ^ 2271560481) & 0xFFFFFFFF
o0o0o8 = ((o0o0o3 >> 12) ^ 2882400000) & 0xFFFFFFFF
# 生成轮密钥
keys = []
o0o0o11 = 0
for _ in range(32):
o0o0o11 = (o0o0o11 + o0o0o4) & 0xFFFFFFFF
keys.append(o0o0o11)
# 逆向Feistel网络
for i in range(31, -1, -1):
o0o0o11 = keys[i]
# 逆向右半部分
R_prev = (R - (((L << 4) + o0o0o7) ^ (L + o0o0o11) ^ ((L >> 4) + o0o0o8))) & 0xFFFFFFFF
# 逆向左半部分
L_prev = (L - (((R_prev << 4) + o0o0o5) ^ (R_prev + o0o0o11) ^ ((R_prev >> 4) + o0o0o6))) & 0xFFFFFFFF
L, R = L_prev, R_prev
return L, R
def Carlotta_inv(output_P, output_Q, o0oE, o0oF):
# 逆向Carlotta函数
o0oH = 305419896
o0oI = o0oE & 0xFFFF
o0oJ = (o0oE >> 16) & 0xFFFF
o0oK = (o0oE ^ o0oF) & 0xFFFF
o0oL = ((o0oE >> 8) ^ o0oF) & 0xFFFF
o0oM = (o0oH * (o0oF + 1)) & 0xFFFFFFFF
# 第二轮逆向
o0oN2 = (((output_P << 5) + o0oK) ^ (output_P + o0oM) ^ ((output_P >> 5) + o0oL)) & 0xFFFFFFFF
o0oD = (output_Q - o0oN2) & 0xFFFF
# 第一轮逆向
o0oN1 = (((o0oD << 5) + o0oI) ^ (o0oD + o0oM) ^ ((o0oD >> 5) + o0oJ)) & 0xFFFFFFFF
o0oC = (output_P - o0oN1) & 0xFFFF
return o0oC, o0oD
def find_original_input():
# 目标输出
target = [105084753, 3212558540, 351342182, 844102737, 2002504052, 356536456, 2463183122, 615034880, 1156203296]
# 步骤1: 逆向changli操作链
# 从后往前逆向changli操作
state = target.copy()
# 逆向8轮changli操作
for i in range(7, -1, -1):
L_prev, R_prev = changli_inv(state[i], state[i+1], 2025)
state[i] = L_prev
state[i+1] = R_prev
# 步骤2: 逆向Carlotta和Shorekeeper操作
original_input = []
for j in range(9):
# 从state[j]中提取Carlotta的输出
output_P = (state[j] >> 16) & 0xFFFF
output_Q = state[j] & 0xFFFF
# Carlotta函数的参数
o0oE = j + 2025 # 索引 + 2025
o0oF = j * j # 索引的平方
# 逆向Carlotta得到Shorekeeper的输出
o0oC, o0oD = Carlotta_inv(output_P, output_Q, o0oE, o0oF)
# 合并得到原始输入
original_val = (o0oC << 16) | o0oD
original_input.append(original_val)
return original_input
# 计算原始key
original_key = find_original_input()
print("原始key:", original_key)
# 验证结果
def verify_solution(input_key):
# 重新实现shouan函数来验证
if len(input_key) != 9:
raise ValueError("需要输入9个key")
o0o0o35 = []
for o0o0o49, o0o0o34 in enumerate(input_key):
o0o0o33 = o0o0o49 * o0o0o49
# Shorekeeper操作
o0o0o13 = o0o0o34 >> 16
o0o0o14 = o0o0o34 & 0xFFFF
# Carlotta操作
o0oE = o0o0o49 + 2025
o0oF = o0o0o33
o0oH = 305419896
o0oI = o0oE & 0xFFFF
o0oJ = (o0oE >> 16) & 0xFFFF
o0oK = (o0oE ^ o0oF) & 0xFFFF
o0oL = ((o0oE >> 8) ^ o0oF) & 0xFFFF
o0oM = (o0oH * (o0oF + 1)) & 0xFFFFFFFF
o0oN = (((o0o0o14 << 5) + o0oI) ^ (o0o0o14 + o0oM) ^ ((o0o0o14 >> 5) + o0oJ)) & 0xFFFFFFFF
o0oP = (o0o0o13 + o0oN) & 0xFFFF
o0oN = (((o0oP << 5) + o0oK) ^ (o0oP + o0oM) ^ ((o0oP >> 5) + o0oL)) & 0xFFFFFFFF
o0oQ = (o0o0o14 + o0oN) & 0xFFFF
o0o0o40 = (o0oP << 16) | o0oQ
o0o0o35.append(o0o0o40)
o0o0o41 = []
for i in range(8):
L, R = changli(o0o0o35[i], o0o0o35[i+1], 2025)
o0o0o35[i] = L
o0o0o35[i+1] = R
o0o0o41.append(L)
o0o0o41.append(o0o0o35[8])
return o0o0o41
# 重新定义changli函数用于验证
def changli(o0o0o1, o0o0o2, o0o0o3):
o0o0o4 = 2269471011
o0o0o5 = o0o0o3 & 0xFFFFFFFF
o0o0o6 = ((o0o0o3 >> 8) ^ 305419896) & 0xFFFFFFFF
o0o0o7 = ((o0o0o3 << 4) ^ 2271560481) & 0xFFFFFFFF
o0o0o8 = ((o0o0o3 >> 12) ^ 2882400000) & 0xFFFFFFFF
o0o0o9 = o0o0o1 & 0xFFFFFFFF
o0o0o10 = o0o0o2 & 0xFFFFFFFF
o0o0o11 = 0
for _ in range(32):
o0o0o11 = (o0o0o11 + o0o0o4) & 0xFFFFFFFF
o0o0o9 = (o0o0o9 + (((o0o0o10 << 4) + o0o0o5) ^ (o0o0o10 + o0o0o11) ^ ((o0o0o10 >> 4) + o0o0o6))) & 0xFFFFFFFF
o0o0o10 = (o0o0o10 + (((o0o0o9 << 4) + o0o0o7) ^ (o0o0o9 + o0o0o11) ^ ((o0o0o9 >> 4) + o0o0o8))) & 0xFFFFFFFF
return (o0o0o9, o0o0o10)
# 验证结果
print("验证结果:", verify_solution(original_key))
print("目标输出:", [105084753, 3212558540, 351342182, 844102737, 2002504052, 356536456, 2463183122, 615034880, 1156203296])
print("验证通过:", verify_solution(original_key) == [105084753, 3212558540, 351342182, 844102737, 2002504052, 356536456, 2463183122, 615034880, 1156203296])deepseek记录
https://chat.deepseek.com/share/kjctuy9d9s1ndd4yqx
使用
https://github.com/Lil-House/Pyarmor-Static-Unpack-1shot
解
但是py头被删了
补上PY000000
自己打包一份就知道了
反编译出来这样
把之前的key给ai
GD1
godot engine
https://in1t.top/2024/01/23/godot-%E5%BC%95%E6%93%8E%E9%80%86%E5%90%91%E5%88%9D%E6%8E%A2/
解包后，直接使用记事本打开main.gd
把main丢ai
binary_stream = (
"00000110100000000110010100001000001100000110011100001000010000000111000000010010"
"001100010010000000000110011100010001011100000110011000010000010100000111000000001"
"000100100010001010000000100010100010001011100000101001100001001011100001000000000"
"000101000000000100010100001000000100010000011000010001010100010001001000000111010"
"100010000011100000100010100010001010000010000010000000100100000000111011000000111"
"100100000100010100010001100100000101011100001000011100001001000000000101011000000"
"1101000000100000001000010000011000100100101"
)
decoded_text = ""
for pos in range(0, len(binary_stream), 12):
segment = binary_stream[pos:pos + 12]
high_bits = int(segment[:4], 2)
mid_bits = int(segment[4:8], 2)
low_bits = int(segment[8:], 2)
ascii_code = high_bits * 100 + mid_bits * 10 + low_bits
decoded_text += chr(ascii_code)
print(decoded_text)
eztauri
根据题目描述可以得知是tauri的程序
https://blog.yllhwa.com/2023/05/09/Tauri%20%E6%A1%86%E6%9E%B6%E7%9A%84%E9%9D%99%E6%80%81%E8%B5%84%E6%BA%90%E6%8F%90%E5%8F%96%E6%96%B9%E6%B3%95%E6%8E%A2%E7%A9%B6/
i还有rust和javascript写的程序
搜索flag找到一个html
交叉引用找到地址
把index_flag.html dump下来解密
参考最开始的连接
把所有的js dump下来
# idapython: dump_if_contains_js.py
# 严格规则：当 filename 包含 ".js" 或 data 前样本包含 ".js" 时，dump 完整数据（不判断其它类型）
# 结构（64-bit）:
# qword @+0x0 -> filename_ptr
# qword @+0x10 -> data_ptr
# qword @+0x18 -> length (little-endian qword)
#
# 配置 START_EA=None 则扫描 .rdata 段；否则从 START_EA 开始按 ENTRY_SIZE 步长扫描。
import os, time
try:
import idaapi, ida_bytes, ida_segment, idc
except Exception as e:
print("请在 IDA 的 IDAPython 环境中运行。错误：", e)
raise
# ========== 配置 ==========
START_EA = 0x0000000140642660 # 起始地址，改为 None 则自动在 .rdata 段内扫描
SEG_NAME = ".rdata"
ENTRY_SIZE = 0x20
MAX_DUMP_SIZE = 50 * 1024 * 1024 # 最大 dump 大小（50MB，防误读）
SAMPLE_SIZE = 8192 # 用于检测的样本长度（字节）
OUTPUT_DIR = None # None -> 使用被分析文件所在目录
VERBOSE = True
MAX_ENTRIES = 20000 # 最多扫描条目数（防无限循环）
# ========== 工具函数 ==========
def read_bytes(ea, n):
return ida_bytes.get_bytes(ea, n)
def read_qword(ea):
b = read_bytes(ea, 8)
if not b or len(b) < 8:
return None
return int.from_bytes(b, "little")
def is_mapped_address(addr):
if not addr:
return False
return idaapi.getseg(addr) is not None
def safe_get_cstring(addr, maxlen=4096):
if not addr:
return None
try:
s = idc.get_strlit_contents(addr, -1, idc.STRTYPE_C)
if s:
return s.decode('utf-8', 'ignore')
except Exception:
pass
b = read_bytes(addr, min(maxlen, 4096))
if not b:
return None
i = b.find(b'\x00')
if i >= 0:
return b[:i].decode('utf-8', 'ignore')
return b.decode('utf-8', 'ignore')
def sanitize_filename(name):
if not name:
name = "resource"
name = name.replace("\\", "/")
base = name.split("/")[-1]
if not base:
base = "resource"
base = "".join(ch if (31 < ord(ch) < 127) else "_" for ch in base)
if len(base) > 200:
base = base[:200]
return base
def unique_path(directory, filename):
path = os.path.join(directory, filename)
base, ext = os.path.splitext(filename)
i = 1
while os.path.exists(path):
path = os.path.join(directory, f"{base}_{i}{ext}")
i += 1
return path
# ========== 主流程 ==========
def main():
global START_EA, OUTPUT_DIR
print("[*] dump_if_contains_js.py 启动")
# 输出目录
if OUTPUT_DIR:
out_dir = OUTPUT_DIR
else:
try:
in_path = idaapi.get_input_file_path()
out_dir = os.path.dirname(in_path) or os.getcwd()
except Exception:
out_dir = os.getcwd()
os.makedirs(out_dir, exist_ok=True)
print("[*] 输出目录：", out_dir)
# 决定扫描起点与终点
if START_EA is None:
seg = ida_segment.get_segm_by_name(SEG_NAME)
if not seg:
# 模糊匹配包含 rdata 的段名
seg = None
ea_tmp = idaapi.get_first_seg()
while ea_tmp != idaapi.BADADDR:
s = idaapi.getseg(ea_tmp)
if not s:
break
try:
name = ida_segment.get_segm_name(s)
except:
try:
name = idaapi.get_segm_name(s)
except:
name = ""
if name and SEG_NAME.lower() in name.lower():
seg = s
break
ea_tmp = s.end_ea
if not seg:
print("[-] 未找到段 '%s'，请设置 START_EA" % SEG_NAME)
return
start = seg.start_ea
end = seg.end_ea
else:
start = START_EA
seg = idaapi.getseg(start)
if seg:
end = seg.end_ea
else:
end = start + ENTRY_SIZE * MAX_ENTRIES
print("[*] 扫描区间: 0x%X - 0x%X (步长 0x%X)" % (start, end, ENTRY_SIZE))
ea = start
dumped = 0
scanned = 0
while ea < end and scanned < MAX_ENTRIES:
scanned += 1
try:
fname_ptr = read_qword(ea)
if not fname_ptr or not is_mapped_address(fname_ptr):
ea += ENTRY_SIZE
continue
fname = safe_get_cstring(fname_ptr)
# 读取 data_ptr 和 length（必须存在）
data_ptr = read_qword(ea + 0x10)
length = read_qword(ea + 0x18)
if not data_ptr or not length:
ea += ENTRY_SIZE
continue
if not is_mapped_address(data_ptr):
ea += ENTRY_SIZE
continue
if length <= 0 or length > MAX_DUMP_SIZE:
if VERBOSE:
print("[!] 跳过 entry@0x%X，长度异常: %s" % (ea, str(length)))
ea += ENTRY_SIZE
continue
# 读取样本（用于判断是否包含 ".js"）, 小写字节比较
sample_len = min(length, SAMPLE_SIZE)
sample = read_bytes(data_ptr, sample_len) or b""
sample_lower = sample.lower() if isinstance(sample, bytes) else bytes(sample).lower()
# 判断逻辑：只要 filename 包含 ".js"（不区分大小写）或样本包含 b'.js' 就 dump
fname_has_js = False
if fname:
try:
fname_has_js = ('.js' in fname.lower())
except:
fname_has_js = False
sample_has_js = b'.js' in sample_lower
if not (fname_has_js or sample_has_js):
if VERBOSE:
# 输出少量信息便于排查
print("[-] 非 .js，跳过 entry@0x%X name=%s data@0x%X len=%d" % (ea, fname if fname else "None", data_ptr, length))
ea += ENTRY_SIZE
continue
# 读取完整数据并写文件
data = read_bytes(data_ptr, length)
if data is None:
if VERBOSE:
print("[!] 无法读取完整数据 data@0x%X len=%d" % (data_ptr, length))
ea += ENTRY_SIZE
continue
# 生成文件名：优先使用原名（若存在），若没有或不合理则生成 res_<addr>.js
if fname and '.js' in fname.lower():
clean_name = sanitize_filename(fname)
# 若没有扩展名，追加 .js
if os.path.splitext(clean_name)[1] == "":
clean_name += '.js'
else:
clean_name = "res_%X.js" % data_ptr
out_path = unique_path(out_dir, clean_name)
with open(out_path, 'wb') as f:
f.write(data)
dumped += 1
print("[+] DUMP: %s (entry@0x%X, data@0x%X, len=%d)" % (out_path, ea, data_ptr, length))
# 在 IDA 上添加注释 / 命名
try:
idc.set_name(ea, "js_res_entry_%X" % ea, idc.SN_CHECK)
idc.set_name(data_ptr, "js_res_data_%X" % data_ptr, idc.SN_CHECK)
idc.set_cmt(ea, "dumped -> %s (contains .js)" % os.path.basename(out_path), 0)
except Exception:
pass
except Exception as ex:
print("[-] 异常 @0x%X: %s" % (ea, ex))
ea += ENTRY_SIZE
print("[*] 完成。扫描条目数: %d, 成功 dump: %d 个文件" % (scanned, dumped))
if __name__ == "__main__":
main()
import os
import brotli
# 当前文件夹
folder_path = os.getcwd()
output_folder = os.path.join(folder_path, "decompressed_files")
# 创建输出文件夹
os.makedirs(output_folder, exist_ok=True)
# 遍历文件夹中的所有文件
for filename in os.listdir(folder_path):
file_path = os.path.join(folder_path, filename)
# 跳过文件夹
if os.path.isdir(file_path):
continue
try:
with open(file_path, "rb") as f:
compressed_data = f.read()
decompressed_data = brotli.decompress(compressed_data)
# 构造输出文件名
output_name = f"{os.path.splitext(filename)[0]}_decompressed{os.path.splitext(filename)[1]}"
output_path = os.path.join(output_folder, output_name)
with open(output_path, "wb") as f:
f.write(decompressed_data)
print(f"[SUCCESS] {filename} -> {output_name}")
except brotli.error:
print(f"[FAILED] {filename} is not a valid Brotli file.")
except Exception as e:
print(f"[ERROR] {filename} caused an error: {e}")
然后分析一下结构
把这些js都丢给ai分析
把代码量不多的都可以删了
分析出来两个文件存在加密函数
一个是main.js一个是html_actuator.js
main.js
html_actuator可能性跟高一点
分析出来是
前端 RC4 加密、Base64 编码后发给 Tauri 后 端 greet
让ai写脚本获取xor流
// 原始混淆代码保持不变
(function(_0x97aee2,_0x14d3d9){const _0x151017=_0x363b,_0x2b0390=_0x97aee2();while(!![]){try{const _0x3b9dd4=parseInt(_0x151017(0xb0))/0x1+parseInt(_0x151017(0xac))/0x2+parseInt(_0x151017(0xaa))/0x3+-parseInt(_0x151017(0xab))/0x4+-parseInt(_0x151017(0xa7))/0x5*(parseInt(_0x151017(0xa8))/0x6)+-parseInt(_0x151017(0xae))/0x7*(-parseInt(_0x151017(0xa6))/0x8)+-parseInt(_0x151017(0xad))/0x9;if(_0x3b9dd4===_0x14d3d9)break;else _0x2b0390['push'](_0x2b0390['shift']());}catch(_0x34886e){_0x2b0390['push'](_0x2b0390['shift']());}}}(_0x3a0b,0x6e7b4));
function Encrypt_0x5031b3(_0x5031b3, _0xa31304){const _0x22bac7=_0x363b,_0x5d7b84=new TextEncoder()[_0x22bac7(0xa9)](_0x5031b3),_0x2db5b9=new TextEncoder()[_0x22bac7(0xa9)](_0xa31304),_0x1f7f86=new Uint8Array(0x100);let _0x562e52=0x0;for(let _0x24ca0d=0x0; _0x24ca0d<0x100; _0x24ca0d++){_0x1f7f86[_0x24ca0d]=_0x24ca0d,_0x562e52=(_0x562e52+_0x1f7f86[_0x24ca0d]+_0x5d7b84[_0x24ca0d%_0x5d7b84[_0x22bac7(0xaf)]])%0x100,[_0x1f7f86[_0x24ca0d],_0x1f7f86[_0x562e52]]=[_0x1f7f86[_0x562e52],_0x1f7f86[_0x24ca0d]];}let _0x5b36c3=0x0,_0x205ec1=0x0;const _0x444cf9=new Uint8Array(_0x2db5b9[_0x22bac7(0xaf)]);for(let _0x527286=0x0; _0x527286<_0x2db5b9[_0x22bac7(0xaf)]; _0x527286++){_0x5b36c3=(_0x5b36c3+0x1)%0x100,_0x205ec1=(_0x205ec1+_0x1f7f86[_0x5b36c3])%0x100,[_0x1f7f86[_0x5b36c3],_0x1f7f86[_0x205ec1]]=[_0x1f7f86[_0x205ec1],_0x1f7f86[_0x5b36c3]];const _0x326832=(_0x1f7f86[_0x5b36c3]+_0x1f7f86[_0x205ec1])%0x100;_0x444cf9[_0x527286]=_0x2db5b9[_0x527286]^_0x1f7f86[_0x326832];}return _0x444cf9;}function _0x363b(_0x3e7d70, _0x4a2c88){const _0x3a0bb6=_0x3a0b();return _0x363b=function(_0x363b1f, _0x4025c1){_0x363b1f=_0x363b1f-0xa6;let _0x387f5b=_0x3a0bb6[_0x363b1f];return _0x387f5b;},_0x363b(_0x3e7d70,_0x4a2c88);}function _0x3a0b(){const _0x37fb1e=['3283052tzDAvB','542866JdmzNj','4112658rTyTXQ','16954tUYpad','length','457163LwGIuU','2696pusaTH','233035azfeoA','66oGYEyB','encode','2094372kZRrIa'];_0x3a0b=function(){return _0x37fb1e;};return _0x3a0b();}
// 提取keystream的代码
const key = "SAdt0ngY1AIrC4hH";
const plaintext = 'a'.repeat(64); // 64个'a'
// 使用原始函数加密
const encrypted = Encrypt_0x5031b3(key, plaintext);
// 提取keystream: ciphertext XOR plaintext = keystream
const keystream = [];
const aCharCode = 'a'.charCodeAt(0); // 97
for (let i = 0; i < encrypted.length; i++) {
keystream.push(encrypted[i] ^ aCharCode);
}
// 按要求的格式输出
console.log('KEYSTREAM = [', keystream.join(','), ']');
node -e "(function(_0x97aee2,_0x14d3d9){const _0x151017=_0x363b,_0x2b0390=_0x97aee2();while(!![]){try{const _0x3b9dd4=parseInt(_0x151017(0xb0))/0x1+parseInt(_0x151017(0xac))/0x2+parseInt(_0x151017(0xaa))/0x3+-parseInt(_0x151017(0xab))/0x4+-parseInt(_0x151017(0xa7))/0x5*(parseInt(_0x151017(0xa8))/0x6)+-parseInt(_0x151017(0xae))/0x7*(-parseInt(_0x151017(0xa6))/0x8)+-parseInt(_0x151017(0xad))/0x9;if(_0x3b9dd4===_0x14d3d9)break;else _0x2b0390['push'](_0x2b0390['shift']());}catch(_0x34886e){_0x2b0390['push'](_0x2b0390['shift']());}}}(_0x3a0b,0x6e7b4));function Encrypt_0xa31304(_0x5031b3, _0xa31304){const _0x22bac7=_0x363b,_0x5d7b84=new TextEncoder()[_0x22bac7(0xa9)](_0x5031b3),_0x2db5b9=new TextEncoder()[_0x22bac7(0xa9)](_0xa31304),_0x1f7f86=new Uint8Array(0x100);let _0x562e52=0x0;for(let _0x24ca0d=0x0; _0x24ca0d<0x100; _0x24ca0d++){_0x1f7f86[_0x24ca0d]=_0x24ca0d,_0x562e52=(_0x562e52+_0x1f7f86[_0x24ca0d]+_0x5d7b84[_0x24ca0d%_0x5d7b84[_0x22bac7(0xaf)]])%0x100,[_0x1f7f86[_0x24ca0d],_0x1f7f86[_0x562e52]]=[_0x1f7f86[_0x562e52],_0x1f7f86[_0x24ca0d]];}let _0x5b36c3=0x0,_0x205ec1=0x0;const _0x444cf9=new Uint8Array(_0x2db5b9[_0x22bac7(0xaf)]);for(let _0x527286=0x0; _0x527286<_0x2db5b9[_0x22bac7(0xaf)]; _0x527286++){_0x5b36c3=(_0x5b36c3+0x1)%0x100,_0x205ec1=(_0x205ec1+_0x1f7f86[_0x5b36c3])%0x100,[_0x1f7f86[_0x5b36c3],_0x1f7f86[_0x205ec1]]=[_0x1f7f86[_0x205ec1],_0x1f7f86[_0x5b36c3]];const _0x326832=(_0x1f7f86[_0x5b36c3]+_0x1f7f86[_0x205ec1])%0x100;_0x444cf9[_0x527286]=_0x2db5b9[_0x527286]^_0x1f7f86[_0x326832];}return _0x444cf9;}function _0x363b(_0x3e7d70,_0x4a2c88){const _0x3a0bb6=_0x3a0b();return _0x363b=function(_0x363b1f,_0x4025c1){_0x363b1f=_0x363b1f-0xa6;let _0x387f5b=_0x3a0bb6[_0x363b1f];return _0x387f5b;},_0x363b(_0x3e7d70,_0x4a2c88);}function _0x3a0b(){const _0x37fb1e=['3283052tzDAvB','542866JdmzNj','4112658rTyTXQ','16954tUYpad','length','457163LwGIuU','2696pusaTH','233035azfeoA','66oGYEyB','encode','2094372kZRrIa'];_0x3a0b=function(){return _0x37fb1e;};return _0x3a0b();}const key='SadTongYiAiRC4HH';const plaintext='a'.repeat(64);const encrypted=Encrypt_0xa31304(key,plaintext);const keystream=[];const aCharCode='a'.charCodeAt(0);for(let i=0;i<encrypted.length;i++){keystream.push(encrypted[i]^aCharCode);}console.log('KEYSTREAM = [',keystream.join(','),']');"
KEYSTREAM = [ 232,0,230,97,0,0,88,88,0,118,233,0,91,8,29,213,0,224,188,251,252,20,20,0,0,0,0,0,0,0,222,119,0,0,177,0,0,0,0,0,0,0,149,8,120,233,187,175,0,3,3,0,238,96,0,0,241,87,73,96,0,31,31,0 ]
PS C:\Users\administered>
先从base64开始看起
把这串东西丢给ai
// Hidden C++ exception states: #wind=8
char __fastcall sub_1400356D0(__int64 a1, __int64 a2)
{
const void *v3; // rsi
__int64 v5; // r9
char *v6; // rsi
size_t n8_1; // r12
__int64 Buf1_4; // r8
unsigned __int64 i_1; // rdi
size_t n8; // r15
unsigned int v11; // r14d
unsigned int v12; // r13d
int n32; // eax
int n2117703607; // ecx
unsigned __int64 v15; // rdi
char *Buf1_1; // rdx
_QWORD *v17; // r10
unsigned __int64 i; // rbx
unsigned __int8 v19; // r12
unsigned int v20; // r14d
unsigned int v21; // r13d
char v22; // si
unsigned __int64 v23; // r15
char *Buf1_9; // rax
char *v25; // r15
char v26; // r12
unsigned __int64 v27; // rsi
char *v28; // rax
char *v29; // rsi
char v30; // r14
unsigned __int64 v31; // r15
char *v32; // rax
char *v33; // r15
char v34; // si
unsigned __int64 v35; // rdx
char *v36; // rax
_QWORD *v37; // r12
_QWORD *v38; // r12
unsigned __int64 i_2; // rcx
unsigned int v40; // ebx
char v41; // si
unsigned __int64 v42; // rdi
char *Buf1_5; // rax
__int64 v44; // rbx
char *v45; // rdi
char v46; // bl
unsigned __int64 v47; // r10
char *v48; // rcx
__int64 v49; // rax
char *n74; // r10
char *v51; // rdx
char *n74_1; // rcx
char *v53; // rcx
__int64 v54; // rdi
__int64 v55; // rbx
unsigned __int8 v56; // si
unsigned int v57; // r14d
char v58; // bl
unsigned __int64 v59; // rdi
char *Buf1_2; // rax
int v61; // esi
char *v62; // rdi
char v63; // si
unsigned __int64 v64; // rbx
char *v65; // rcx
__int64 v66; // r14
__int64 v67; // rax
char *v68; // rbx
char v69; // si
char *v70; // rcx
unsigned __int64 v71; // rdx
char *v72; // rdx
char *v73; // rcx
__int64 v74; // rax
__int64 v75; // rsi
__int64 v76; // rcx
__int64 v77; // rsi
__int64 v78; // rax
char *Buf1_6; // r14
char *n74_2; // rsi
char *n74_3; // rsi
char *Buf1_3; // r15
char *v83; // rsi
__int64 v84; // [rsp+20h] [rbp-60h]
_BYTE Dst[520]; // [rsp+38h] [rbp-48h] BYREF
_QWORD v86[50]; // [rsp+240h] [rbp+1C0h] BYREF
__int128 v87; // [rsp+3D0h] [rbp+350h] BYREF
__int64 v88; // [rsp+3E0h] [rbp+360h]
void *Src[2]; // [rsp+3E8h] [rbp+368h] BYREF
size_t Size[2]; // [rsp+3F8h] [rbp+378h]
_QWORD v91[50]; // [rsp+408h] [rbp+388h] BYREF
__int64 v92; // [rsp+598h] [rbp+518h] BYREF
__int128 v93; // [rsp+5A0h] [rbp+520h]
__int128 v94; // [rsp+5B0h] [rbp+530h]
__int128 v95; // [rsp+5C0h] [rbp+540h] BYREF
void *Buf1_7; // [rsp+5D0h] [rbp+550h]
__int64 v97; // [rsp+5D8h] [rbp+558h]
void *Buf1; // [rsp+5E0h] [rbp+560h]
__int64 v99; // [rsp+5E8h] [rbp+568h]
__int64 Buf1_8; // [rsp+5F0h] [rbp+570h]
char v101; // [rsp+5FFh] [rbp+57Fh]
__int64 v102; // [rsp+600h] [rbp+580h]
v102 = -2;
if ( *(_QWORD *)(a2 + 472) != 11
|| **(_QWORD **)(a2 + 464) ^ 0x6D6D6F635F637069LL | *(_QWORD *)(*(_QWORD *)(a2 + 464) + 3LL) ^ 0x646E616D6D6F635FLL )
{
sub_14000E200(a2);
return 0;
}
v3 = (const void *)(a2 + 520);
memcpy(Dst, (const void *)a2, sizeof(Dst));
memcpy(v86, v3, sizeof(v86));
Buf1_7 = *(void **)(a2 + 936);
v95 = *(_OWORD *)(a2 + 920);
v91[6] = 0;
v91[0] = aIpcCommand;
v91[1] = 11;
v91[2] = aName_0;
v91[3] = 4;
v91[4] = Dst;
v91[5] = &v95;
v101 = 1;
sub_1402E0C00(Src, v91);
if ( LOBYTE(Src[0]) != 6 )
{
v94 = *(_OWORD *)Size;
v93 = *(_OWORD *)Src;
memcpy(v91, v3, 0x168u);
v87 = *(_OWORD *)(a2 + 880);
v88 = *(_QWORD *)(a2 + 896);
v92 = 1;
v101 = 0;
sub_140277AC0((unsigned int)v91, v86[48], (unsigned int)&v92, (unsigned int)&v87, v86[49], HIDWORD(v86[49]));
goto LABEL_83;
}
v6 = (char *)Src[1];
n8_1 = Size[0];
v91[0] = 0;
v91[1] = 1;
v91[2] = 0;
Buf1_4 = 1;
if ( Size[0] )
{
Buf1_8 = 1;
i_1 = 0;
do
{
n8 = 8;
if ( n8_1 < 8 )
n8 = n8_1;
v92 = 0;
memcpy(&v92, v6, n8);
v11 = v92;
v12 = HIDWORD(v92);
n32 = 32;
n2117703607 = 2117703607;
do
{
v11 += (16 * v12 + 1668048215) ^ (v12 + n2117703607) ^ ((v12 >> 5) + 1949527375);
v5 = (16 * v11 + 1937076784) ^ (n2117703607 + v11);
v12 += v5 ^ ((v11 >> 5) + 1432441972);
n2117703607 += 2117703607;
--n32;
}
while ( n32 );
if ( v91[0] - i_1 <= 3 )
{
sub_1405C98F0((unsigned int)v91, i_1, 4, 1, 1);
Buf1_8 = v91[1];
i_1 = v91[2];
}
*(_DWORD *)(Buf1_8 + i_1) = _byteswap_ulong(v11);
v15 = i_1 + 4;
v91[2] = v15;
if ( v91[0] - v15 <= 3 )
{
sub_1405C98F0((unsigned int)v91, v15, 4, 1, 1);
v15 = v91[2];
}
v6 += n8;
n8_1 -= n8;
Buf1_8 = v91[1];
*(_DWORD *)(v91[1] + v15) = _byteswap_ulong(v12);
i_1 = v15 + 4;
v91[2] = i_1;
}
while ( n8_1 );
v99 = v91[0];
Buf1_4 = 1;
}
else
{
i_1 = 0;
Buf1_8 = 1;
v99 = 0;
}
v91[0] = 0;
v91[1] = 1;
v91[2] = 0;
Buf1_1 = 0;
v17 = v91;
for ( i = 0; i + 2 < i_1; i += 3LL )
{
if ( i >= i_1 )
sub_1405DC1E8(i, i_1, &off_1405E0BE8, v5, v84);// "src\\lib.rs"
if ( i + 1 >= i_1 )
sub_1405DC1E8(i + 1, i_1, &off_1405E0C00, v5, v84);// "src\\lib.rs"
v19 = *(_BYTE *)(Buf1_8 + i);
v20 = *(unsigned __int8 *)(Buf1_8 + i + 1);
v21 = *(unsigned __int8 *)(Buf1_8 + i + 2);
v22 = BASE64_table_1405E0B90[v19 >> 2];
v23 = (v22 < 0) + 1LL;
Buf1_9 = Buf1_1;
if ( v23 <= v91[0] - (_QWORD)Buf1_1 )
{
if ( v22 >= 0 )
goto LABEL_27;
LABEL_26:
Buf1_9[Buf1_4 + 1] = v22 & 0xBF;
v22 = ((unsigned __int8)v22 >> 6) | 0xC0;
goto LABEL_27;
}
Buf1 = Buf1_1;
sub_1405C98F0((_DWORD)v17, (_DWORD)Buf1_1, (v22 < 0) + 1, 1, 1);
Buf1_4 = v91[1];
Buf1_9 = (char *)v91[2];
Buf1_1 = (char *)Buf1;
v17 = v91;
if ( v22 < 0 )
goto LABEL_26;
LABEL_27:
Buf1_9[Buf1_4] = v22;
v25 = &Buf1_1[v23];
v91[2] = v25;
v26 = BASE64_table_1405E0B90[(16 * v19) & 0x30 | (v20 >> 4)];
v27 = (v26 < 0) + 1LL;
v28 = v25;
if ( v27 <= v91[0] - (_QWORD)v25 )
{
Buf1_4 = v91[1];
if ( v26 >= 0 )
goto LABEL_30;
LABEL_29:
v28[Buf1_4 + 1] = v26 & 0xBF;
v26 = ((unsigned __int8)v26 >> 6) | 0xC0;
goto LABEL_30;
}
sub_1405C98F0((_DWORD)v17, (_DWORD)v25, (v26 < 0) + 1, 1, 1);
v28 = (char *)v91[2];
v17 = v91;
Buf1_4 = v91[1];
if ( v26 < 0 )
goto LABEL_29;
LABEL_30:
v28[Buf1_4] = v26;
v29 = &v25[v27];
v91[2] = v29;
v30 = BASE64_table_1405E0B90[4 * (v20 & 0xF) + (v21 >> 6)];
v31 = (v30 < 0) + 1LL;
v32 = v29;
if ( v31 <= v91[0] - (_QWORD)v29 )
{
if ( v30 >= 0 )
goto LABEL_33;
LABEL_32:
v32[Buf1_4 + 1] = v30 & 0xBF;
v30 = ((unsigned __int8)v30 >> 6) | 0xC0;
goto LABEL_33;
}
v37 = v17;
sub_1405C98F0((_DWORD)v17, (_DWORD)v29, (v30 < 0) + 1, 1, 1);
Buf1_4 = v91[1];
v32 = (char *)v91[2];
v17 = v37;
if ( v30 < 0 )
goto LABEL_32;
LABEL_33:
v32[Buf1_4] = v30;
v33 = &v29[v31];
v91[2] = v33;
v34 = BASE64_table_1405E0B90[v21 & 0x3F];
v35 = (v34 < 0) + 1LL;
v36 = v33;
if ( v35 <= v91[0] - (_QWORD)v33 )
{
if ( v34 >= 0 )
goto LABEL_20;
LABEL_35:
v36[Buf1_4 + 1] = v34 & 0xBF;
v34 = ((unsigned __int8)v34 >> 6) | 0xC0;
goto LABEL_20;
}
v38 = v17;
sub_1405C98F0((_DWORD)v17, (_DWORD)v33, (v34 < 0) + 1, 1, 1);
Buf1_4 = v91[1];
v36 = (char *)v91[2];
v35 = (v34 < 0) + 1LL;
v17 = v38;
if ( v34 < 0 )
goto LABEL_35;
LABEL_20:
v36[Buf1_4] = v34;
Buf1_1 = &v33[v35];
v91[2] = Buf1_1;
}
i_2 = i + 1;
if ( i + 1 != i_1 )
{
if ( i + 2 != i_1 )
goto LABEL_75;
if ( i >= i_1 )
sub_1405DC1E8(i, i_1, &off_1405E0B60, v5, v84);// "src\\lib.rs"
if ( i_2 >= i_1 )
sub_1405DC1E8(i_2, i_1, &off_1405E0B78, v5, v84);// "src\\lib.rs"
v56 = *(_BYTE *)(Buf1_8 + i);
v57 = *(unsigned __int8 *)(Buf1_8 + i + 1);
v58 = BASE64_table_1405E0B90[v56 >> 2];
v59 = (v58 < 0) + 1LL;
Buf1_2 = Buf1_1;
if ( v59 > v91[0] - (_QWORD)Buf1_1 )
{
Buf1_3 = Buf1_1;
sub_1405C98F0((unsigned int)v91, (_DWORD)Buf1_1, (v58 < 0) + 1, 1, 1);
Buf1_4 = v91[1];
Buf1_2 = (char *)v91[2];
Buf1_1 = Buf1_3;
}
v61 = (16 * v56) & 0x30;
if ( v58 < 0 )
{
Buf1_2[Buf1_4 + 1] = v58 & 0xBF;
v58 = ((unsigned __int8)v58 >> 6) | 0xC0;
}
Buf1_2[Buf1_4] = v58;
v62 = &Buf1_1[v59];
v91[2] = v62;
v63 = BASE64_table_1405E0B90[v61 | (v57 >> 4)];
v64 = (v63 < 0) + 1LL;
v65 = v62;
if ( v64 > v91[0] - (_QWORD)v62 )
{
sub_1405C98F0((unsigned int)v91, (_DWORD)v62, (v63 < 0) + 1, 1, 1);
v65 = (char *)v91[2];
}
v66 = (4 * (_BYTE)v57) & 0x3C;
v67 = v91[1];
if ( v63 < 0 )
{
v65[v91[1] + 1] = v63 & 0xBF;
v63 = ((unsigned __int8)v63 >> 6) | 0xC0;
}
v65[v67] = v63;
v68 = &v62[v64];
v91[2] = v68;
v69 = BASE64_table_1405E0B90[v66];
v70 = v68;
v71 = (v69 < 0) + 1LL;
if ( v71 > v91[0] - (_QWORD)v68 )
{
sub_1405C98F0((unsigned int)v91, (_DWORD)v68, (v69 < 0) + 1, 1, 1);
v67 = v91[1];
v70 = (char *)v91[2];
v71 = (v69 < 0) + 1LL;
if ( v69 >= 0 )
goto LABEL_72;
}
else if ( v69 >= 0 )
{
LABEL_72:
v70[v67] = v69;
v72 = &v68[v71];
v91[2] = v72;
v73 = v72;
if ( (char *)v91[0] == v72 )
{
v83 = v72;
sub_1405C98F0((unsigned int)v91, (_DWORD)v72, 1, 1, 1);
v67 = v91[1];
v73 = (char *)v91[2];
v72 = v83;
}
v73[v67] = 61;
Buf1_1 = v72 + 1;
Buf1_4 = v91[1];
LABEL_75:
v54 = v99;
Buf1 = (void *)Buf1_4;
v55 = v91[0];
if ( Buf1_1 != (char *)76 )
goto LABEL_77;
goto LABEL_76;
}
v70[v67 + 1] = v69 & 0xBF;
v69 = ((unsigned __int8)v69 >> 6) | 0xC0;
goto LABEL_72;
}
if ( i >= i_1 )
sub_1405DC1E8(i, i_1, &off_1405E0BD0, v5, v84);// "src\\lib.rs"
v40 = *(unsigned __int8 *)(Buf1_8 + i);
v41 = BASE64_table_1405E0B90[v40 >> 2];
v42 = (v41 < 0) + 1LL;
Buf1_5 = Buf1_1;
if ( v42 > v91[0] - (_QWORD)Buf1_1 )
{
Buf1_6 = Buf1_1;
sub_1405C98F0((unsigned int)v91, (_DWORD)Buf1_1, (v41 < 0) + 1, 1, 1);
Buf1_4 = v91[1];
Buf1_5 = (char *)v91[2];
Buf1_1 = Buf1_6;
v44 = (16 * (_BYTE)v40) & 0x30;
if ( v41 < 0 )
{
LABEL_48:
Buf1_5[Buf1_4 + 1] = v41 & 0xBF;
v41 = ((unsigned __int8)v41 >> 6) | 0xC0;
}
}
else
{
v44 = (16 * (_BYTE)v40) & 0x30;
if ( v41 < 0 )
goto LABEL_48;
}
Buf1_5[Buf1_4] = v41;
v45 = &Buf1_1[v42];
v91[2] = v45;
v46 = BASE64_table_1405E0B90[v44];
v47 = (v46 < 0) + 1LL;
v48 = v45;
if ( v47 > v91[0] - (_QWORD)v45 )
{
sub_1405C98F0((unsigned int)v91, (_DWORD)v45, (v46 < 0) + 1, 1, 1);
v48 = (char *)v91[2];
v47 = (v46 < 0) + 1LL;
v49 = v91[1];
if ( v46 < 0 )
{
LABEL_51:
v48[v49 + 1] = v46 & 0xBF;
v46 = ((unsigned __int8)v46 >> 6) | 0xC0;
}
}
else
{
v49 = v91[1];
if ( v46 < 0 )
goto LABEL_51;
}
v48[v49] = v46;
n74 = &v45[v47];
v91[2] = n74;
v51 = (char *)v91[0];
n74_1 = n74;
if ( (char *)v91[0] == n74 )
{
n74_2 = n74;
sub_1405C98F0((unsigned int)v91, (_DWORD)n74, 1, 1, 1);
v51 = (char *)v91[0];
v49 = v91[1];
n74_1 = (char *)v91[2];
n74 = n74_2;
}
n74_1[v49] = 61;
v53 = n74 + 1;
v91[2] = n74 + 1;
v54 = v99;
if ( v51 == n74 + 1 )
{
n74_3 = n74;
sub_1405C98F0((unsigned int)v91, (_DWORD)v51, 1, 1, 1);
v49 = v91[1];
v53 = (char *)v91[2];
v54 = v99;
n74 = n74_3;
}
v53[v49] = 61;
Buf1 = (void *)v91[1];
v55 = v91[0];
if ( n74 != (char *)74 )
{
LABEL_77:
nullsub_1();
v74 = sub_140001080(3, 1);
if ( !v74 )
{
v97 = v55;
sub_1405DBDA3(1, 3, &off_1405E0B38); // "C:\\Users\\Xierluo\\.rustup\\toolchains\\stable-x86_64-pc-windows-msvc\\lib/rustlib/src/rust\\library\\alloc\\src\\slice.rs"
}
v75 = v74;
*(_BYTE *)(v74 + 2) = 100;
*(_WORD *)v74 = 25922;
if ( v55 )
goto LABEL_79;
goto LABEL_80;
}
LABEL_76:
if ( memcmp(Buf1, aDafDkqxixgmzn0, 0x4Cu) )
goto LABEL_77;
nullsub_1();
v78 = sub_140001080(3, 1);
if ( !v78 )
{
v97 = v55;
sub_1405DBDA3(1, 3, &off_1405E0B38); // "C:\\Users\\Xierluo\\.rustup\\toolchains\\stable-x86_64-pc-windows-msvc\\lib/rustlib/src/rust\\library\\alloc\\src\\slice.rs"
}
v75 = v78;
*(_BYTE *)(v78 + 2) = 110;
*(_WORD *)v78 = 26967;
if ( v55 )
LABEL_79:
sub_140001090(Buf1, v55, 1);
LABEL_80:
if ( v54 )
sub_140001090(Buf1_8, v54, 1);
memcpy(v91, v86, sizeof(v91));
*(_QWORD *)&v93 = 3;
*((_QWORD *)&v93 + 1) = v75;
*(_QWORD *)&v94 = 3;
LOBYTE(v92) = 6;
v101 = 0;
sub_140294520(v91);
LABEL_83:
if ( !__OFSUB__(0, (_QWORD)v95) )
{
v76 = *((_QWORD *)&v95 + 1);
Buf1 = Buf1_7;
Buf1_8 = 0;
v99 = *((_QWORD *)&v95 + 1);
while ( Buf1 != (void *)Buf1_8 )
{
++Buf1_8;
v77 = v76 + 96;
sub_140255E40();
v76 = v77;
}
if ( (_QWORD)v95 )
sub_140001090(*((_QWORD *)&v95 + 1), 96 * v95, 8);
}
sub_14000F550(Dst);
return 1;
}
#!/usr/bin/env python3
import base64
# 后端 .rdata 那串 base64（你给出的）
b64 = "daF/DkQxixGmzn0aPFW2E2PhM8NabRtLjp6pI+c8TtY3WMuPxfnvlAsp9aluf8noZy/T6Sz9DJg="
ct = base64.b64decode(b64)
# 你给的 KEYSTREAM（RC4 xor 流）
KEYSTREAM = [232,0,230,97,0,0,88,88,0,118,233,0,91,8,29,213,0,224,188,251,252,20,20,0,0,0,0,0,0,0,222,119,0,0,177,0,0,0,0,0,0,0,149,8,120,233,187,175,0,3,3,0,238,96,0,0,241,87,73,96,0,31,31,0]
KS = bytes(KEYSTREAM)
# 从反编译还原的常数（对应 C++ 中出现的那些十进制常量）
C1 = 1668048215 # 0x636c6557
C2 = 1949527375 # 0x74336d4f
C3 = 1937076784 # 0x73757230
C4 = 1432441972 # 0x55615474
DELTA = 2117703607 # 0x7e3997b7
def swap32(x):
return ((x & 0xFF) << 24) | ((x & 0xFF00) << 8) | ((x >> 8) & 0xFF00) | ((x >> 24) & 0xFF)
def decrypt_block(block8):
# block8: 8 bytes (as stored in ct)
a = int.from_bytes(block8[0:4], 'little')
b = int.from_bytes(block8[4:8], 'little')
v11 = swap32(a)
v12 = swap32(b)
sum_ = DELTA * 32
for _ in range(32):
v12 = (v12 - ( ((16 * v11 + C3) ^ (sum_ + v11)) ^ ((v11 >> 5) + C4) )) & 0xFFFFFFFF
v11 = (v11 - ( ((16 * v12 + C1) ^ (v12 + sum_)) ^ ((v12 >> 5) + C2) )) & 0xFFFFFFFF
sum_ = (sum_ - DELTA) & 0xFFFFFFFFFFFFFFFF
return v11.to_bytes(4,'little') + v12.to_bytes(4,'little')
# 1) TEA-like 解密（对 ct 按 8 字节块）
plain = bytearray()
for i in range(0, len(ct), 8):
block = ct[i:i+8]
plain += decrypt_block(block)
# 2) 解出的是个 base64 字符串，去除尾部可能的 0x00，再 decode
plain_b64 = bytes(plain).rstrip(b'\x00')
middle = base64.b64decode(plain_b64)
# 3) 用你给的 KEYSTREAM 异或（取 middle 长度）
res = bytes(middle[i] ^ KS[i] for i in range(len(middle)))
print(res.decode())
# -> flag{cf8be09b1c8a415f8b5e8f1dac71d4af}
re2
看plus.py很明显被混淆过
尝试运行一下，一个个试版本发现是3.9
报了个unicorn的错误
![[img/E8XH9BDOX]N7I(7D[YXIW20 1.png]]
装上了之后看一下调用
打印出来
<class 'operator.methodcaller'>
<unicorn.unicorn_py3.arch.intel.UcIntel object at 0x00000241D5D43730>
<cyfunction exec at 0x00000241D5DF3110>
<built-in function input>
<class 'str'>
<class 'operator.methodcaller'>
<built-in function print>
看起来说明 m 是 Python 内置模块 operator 里的类 operator.methodcaller
import re
def simplify_additions_in_file(input_file, output_file):
# 读取原始代码
with open(input_file, "r", encoding="utf-8") as f:
code = f.read()
# 匹配类似 int(7 + 7 + 9 + 3) 这样的表达式
pattern = re.compile(r"int\(([\d+\s+]+)\)")
def replace_expr(match):
expr = match.group(1)
try:
# 计算加法的实际结果
result = eval(expr)
return f"int({result})"
except Exception:
return match.group(0) # 出错就原样返回
# 执行替换
optimized_code = re.sub(pattern, replace_expr, code)
# 保存优化后的结果
with open(output_file, "w", encoding="utf-8") as f:
f.write(optimized_code)
print(f"✅ 已优化完成，结果保存到 {output_file}")
# 使用示例
simplify_additions_in_file("plus.py", "optimized.py")from init import *;m(exec(exit(int(307) + int(922) + int(928) + int(883) + int(0) + int(60) + int(32))),exit(int(167) + int(772) + int(16)),exit(int(209) + int(715) + int(2)))(e);m(exec(exit(int(307) + int(922) + int(928) + int(883) + int(0) + int(60) + int(32))),exit(int(188) + int(743) + int(68)),exit(int(655) + int(36)))(e);m(exec(exit(int(201) + int(800) + int(370) + int(677) + int(125) + int(856) + int(982) + int(9))),exit(int(167) + int(772) + int(16)),exec(exit(int(215) + int(430) + int(820) + int(910) + int(458) + int(736) + int(505) + int(0) + int(51) + int(870) + int(224) + int(350) + int(847) + int(782) + int(563) + int(842) + int(941) + int(767) + int(450) + int(663) + int(266) + int(900) + int(616) + int(936) + int(594) + int(409) + int(721) + int(828) + int(862) + int(0) + int(50) + int(250) + int(877) + int(0) + int(0) + int(7) + int(259) + int(502) + int(951) + int(573) + int(354) + int(763) + int(0) + int(39) + int(390) + int(911) + int(514) + int(251) + int(779) + int(543) + int(944) + int(934) + int(960) + int(684) + int(0) + int(0) + int(8) + int(209) + int(628) + int(473) + int(304) + int(218) + int(610) + int(967) + int(519) + int(892) + int(397) + int(440) + int(123) + int(955) + int(636) + int(948) + int(631) + int(0) + int(47) + int(774) + int(533) + int(721) + int(835) + int(838) + int(0) + int(86) + int(0) + int(12) + int(898) + int(766) + int(274) + int(946) + int(831) + int(732) + int(554) + int(223) + int(371) + int(869) + int(0) + int(0) + int(7) + int(493) + int(373) + int(0) + int(65) + int(194) + int(188) + int(0) + int(38) + int(0) + int(55) + int(945) + int(3))),)(e);m(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(44)),exit(int(189) + int(399) + int(0) + int(3)))(e);m(exec(exit(int(201) + int(800) + int(370) + int(677) + int(125) + int(856) + int(982) + int(9))),exit(int(188) + int(784) + int(64)), i(exec(exit(int(520) + int(485) + int(229) + int(507) + int(545) + int(392) + int(928) + int(716) + int(380) + int(743) + int(873) + int(332) + int(979) + int(750) + int(615) + int(584)))).encode())(e);m(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(39)),exit(int(188) + int(784) + int(64)))(e);m(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(43)),exit(int(44)))(e);m(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(40)),7)(e);m(exec(exit(int(187) + int(100) + int(846) + int(671) + int(655) + int(242) + int(610) + int(0) + int())), exit(int(167) + int(772) + int(16)), exit(int(167) + int(773) + int(32)))(e);p(exec(exit(int(173) + int(535) + int(626) + int(0) + int()))) if (b(m(exec(exit(int(788) + int(282) + int(697) + int(949) + int(0) + int(48) + int(867) + int(6))), exit(int(188) + int(784) + int(64)), exit(int(44)))(e)).decode()== exec(exit(int(636) + int(496) + int(797) + int(464) + int(929) + int(889) + int(819) + int(0) + int(18) + int(589) + int(958) + int(474) + int(261) + int(894) + int(226) + int(380) + int(884) + int(858) + int(896) + int(837) + int(0) + int(50) + int(849) + int(823) + int(120) + int(0) + int(96) + int(559) + int(828) + int(809) + int(884) + int(712) + int(107) + int(801) + int(783) + int(610) + int(237) + int(788) + int(137) + int(0) + int(0) + int(2) + int(972) + int(622) + int(711) + int(849) + int(132) + int(377) + int(866) + int(432) + int(975) + int(817) + int(0) + int(21)))) else p(exec(exit(int(310) + int(844) + int(326) + int(706) + int(854) + int(73)))) #type:ignorefrom init import *;m(exec(exit(3132)),exit(955),exit(926))(e);m(exec(exit(3132)),exit(999),exit(691))(e);m(exec(exit(4020)),exit(955),exec(exit(50720)),)(e);m(exec(exit(3635)),exit(44),exit(591))(e);m(exec(exit(4020)),exit(1036), i(exec(exit(9578))).encode())(e);m(exec(exit(3635)),exit(39),exit(1036))(e);m(exec(exit(3635)),exit(43),exit(44))(e);m(exec(exit(3635)),exit(40),7)(e);m(exec(exit(3311 + int())), exit(955), exit(972))(e);p(exec(exit(1334 + int()))) if (b(m(exec(exit(3637)), exit(1036), exit(44))(e)).decode()== exec(exit(28274))) else p(exec(exit(3113))) #type:ignore再优化一下换行
#!/usr/bin/env python3
# optimize_and_prettify.py
# 用途：将单行混淆 Python 脚本拆行并把 int(...) 加法计算成数字
# 说明：保守替换——只计算由纯数字构成的 int(...) 加法片段，遇到空 int() 或非纯数字的 int(...) 会保留原样。
import re
import shutil
import sys
from pathlib import Path
def optimize_int_sums(text: str) -> str:
"""
将连续的 int(NUM)+int(NUM)+... 替换成它们的和（数字字符串）。
只匹配完全由 int(decimal) 构成的序列；不会触碰空的 int() 或含变量的 int(x)。
"""
# 匹配类似 int(123) + int(456) + int(7)
sum_pattern = re.compile(r'(?:int\(\d+\)(?:\s*\+\s*int\(\d+\))+)')
def sum_repl(m):
nums = re.findall(r'int\((\d+)\)', m.group(0))
total = sum(map(int, nums))
return str(total)
text = sum_pattern.sub(sum_repl, text)
# 再将单独的 int(123) -> 123 （但不改 int()）
text = re.sub(r'\bint\((\d+)\)\b', r'\1', text)
return text
def split_statements_to_lines(text: str) -> str:
"""
将以分号分隔的语句拆成多行，保留 ; 如果它在字符串常量内部则比较复杂——
这里采取保守方法：基于简单分割 `;`，并修复连续 ; 带来的空行。
"""
# 先把 Windows/Mac 换行标准化
text = text.replace('\r\n', '\n').replace('\r', '\n')
# 尝试智能拆分：把每个顶级分号作为换行位置
# 这里用简单分割（对大多数混淆脚本是足够的，因为代码里少用字符串包含分号）
parts = [p.strip() for p in text.split(';')]
# 移除完全空的段
parts = [p for p in parts if p != '']
# 每行以分号结尾（保持语句终止），最后一行如果本来没有分号就不加
lines = []
for i, p in enumerate(parts):
# 如果末尾是注释（# ...），已经在 p 中；我们保留注释
# 对于最后一段：如果原文以分号结尾我们也会保留分号；这里检测比较难，保持每行加分号可以不影响执行
# 但为了更自然，我们不在最后一行添加分号
if i < len(parts) - 1:
lines.append(p + ';')
else:
lines.append(p)
return '\n'.join(lines)
def prettify(text: str) -> str:
"""
主流程：先做数值简化，再拆行；这样可保证像 int(1)+int(2) 这种被合并后再换行。
"""
t = optimize_int_sums(text)
t = split_statements_to_lines(t)
# 额外的清理：去掉多余空行
t = re.sub(r'\n\s*\n+', '\n\n', t)
return t
def backup_file(path: Path):
bak = path.with_suffix(path.suffix + '.bak')
shutil.copy2(path, bak)
print(f"Backup created: {bak}")
def process_file(in_path: Path, out_path: Path = None):
if not in_path.exists():
raise FileNotFoundError(in_path)
if out_path is None:
out_path = in_path.with_name(in_path.stem + '_optimized' + in_path.suffix)
backup_file(in_path)
text = in_path.read_text(encoding='utf-8', errors='ignore')
new_text = prettify(text)
out_path.write_text(new_text, encoding='utf-8')
print(f"Optimized written to: {out_path}")
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python optimize_and_prettify.py <input_file.py> [<output_file.py>]")
sys.exit(1)
inp = Path(sys.argv[1])
out = Path(sys.argv[2]) if len(sys.argv) > 2 else None
try:
process_file(inp, out)
except Exception as e:
print("Error:", e)
sys.exit(2)
from init import *;
m(exec(exit(3132)),exit(955),exit(926))(e);
m(exec(exit(3132)),exit(999),exit(691))(e);
m(exec(exit(4020)),exit(955),exec(exit(50720)),)(e);
m(exec(exit(3635)),exit(44),exit(591))(e);
m(exec(exit(4020)),exit(1036), i(exec(exit(9578))).encode())(e);
m(exec(exit(3635)),exit(39),exit(1036))(e);
m(exec(exit(3635)),exit(43),exit(44))(e);
m(exec(exit(3635)),exit(40),7)(e);
m(exec(exit(3311 + int())), exit(955), exit(972))(e);
p(exec(exit(1334 + int()))) if (b(m(exec(exit(3637)), exit(1036), exit(44))(e)).decode()== exec(exit(28274))) else p(exec(exit(3113))) #type:ignore
所以我们退回上一个版本
然后手动给每个exec加上print
from init import *;
print(exec(exit(int(307) + int(922) + int(928) + int(883) + int(0) + int(60) + int(32))),exit(int(167) + int(772) + int(16)),exit(int(209) + int(715) + int(2)))
print(exec(exit(int(307) + int(922) + int(928) + int(883) + int(0) + int(60) + int(32))),exit(int(188) + int(743) + int(68)),exit(int(655) + int(36)))
print(exec(exit(int(201) + int(800) + int(370) + int(677) + int(125) + int(856) + int(982) + int(9))),exit(int(167) + int(772) + int(16)),exec(exit(int(215) + int(430) + int(820) + int(910) + int(458) + int(736) + int(505) + int(0) + int(51) + int(870) + int(224) + int(350) + int(847) + int(782) + int(563) + int(842) + int(941) + int(767) + int(450) + int(663) + int(266) + int(900) + int(616) + int(936) + int(594) + int(409) + int(721) + int(828) + int(862) + int(0) + int(50) + int(250) + int(877) + int(0) + int(0) + int(7) + int(259) + int(502) + int(951) + int(573) + int(354) + int(763) + int(0) + int(39) + int(390) + int(911) + int(514) + int(251) + int(779) + int(543) + int(944) + int(934) + int(960) + int(684) + int(0) + int(0) + int(8) + int(209) + int(628) + int(473) + int(304) + int(218) + int(610) + int(967) + int(519) + int(892) + int(397) + int(440) + int(123) + int(955) + int(636) + int(948) + int(631) + int(0) + int(47) + int(774) + int(533) + int(721) + int(835) + int(838) + int(0) + int(86) + int(0) + int(12) + int(898) + int(766) + int(274) + int(946) + int(831) + int(732) + int(554) + int(223) + int(371) + int(869) + int(0) + int(0) + int(7) + int(493) + int(373) + int(0) + int(65) + int(194) + int(188) + int(0) + int(38) + int(0) + int(55) + int(945) + int(3))),);
print(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(44)),exit(int(189) + int(399) + int(0) + int(3)));
print(exec(exit(int(201) + int(800) + int(370) + int(677) + int(125) + int(856) + int(982) + int(9))),exit(int(188) + int(784) + int(64)), i(exec(exit(int(520) + int(485) + int(229) + int(507) + int(545) + int(392) + int(928) + int(716) + int(380) + int(743) + int(873) + int(332) + int(979) + int(750) + int(615) + int(584)))).encode());
print(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(39)),exit(int(188) + int(784) + int(64)));
print(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(43)),exit(int(44)));
print(exec(exit(int(211) + int(0) + int(23) + int(573) + int(828) + int(994) + int(606) + int(397) + int(3))),exit(int(40)),7);
print(exec(exit(int(187) + int(100) + int(846) + int(671) + int(655) + int(242) + int(610) + int(0) + int())), exit(int(167) + int(772) + int(16)), exit(int(167) + int(773) + int(32)));
print(exec(exit(int(173) + int(535) + int(626) + int(0) + int())));
print(exec(exit(int(788) + int(282) + int(697) + int(949) + int(0) + int(48) + int(867) + int(6))), exit(int(188) + int(784) + int(64)));
print(exec(exit(int(636) + int(496) + int(797) + int(464) + int(929) + int(889) + int(819) + int(0) + int(18) + int(589) + int(958) + int(474) + int(261) + int(894) + int(226) + int(380) + int(884) + int(858) + int(896) + int(837) + int(0) + int(50) + int(849) + int(823) + int(120) + int(0) + int(96) + int(559) + int(828) + int(809) + int(884) + int(712) + int(107) + int(801) + int(783) + int(610) + int(237) + int(788) + int(137) + int(0) + int(0) + int(2) + int(972) + int(622) + int(711) + int(849) + int(132) + int(377) + int(866) + int(432) + int(975) + int(817) + int(0) + int(21))));
print(exec(exit(int(310) + int(844) + int(326) + int(706) + int(854) + int(73)))); #type:ignore
#!/usr/bin/env python3
# dump_bytes.py -- 将固定的二进制字节写入文件
data = b'\xf3\x0f\x1e\xfaUH\x89\xe5H\x89}\xe8\x89u\xe4\x89\xd0\x88E\xe0\xc7E\xfc\x00\x00\x00\x00\xebL\x8bU\xfcH\x8bE\xe8H\x01\xd0\x0f\xb6\x00\x8d\x0c\xc5\x00\x00\x00\x00\x8bU\xfcH\x8bE\xe8H\x01\xd0\x0f\xb6\x002E\xe0\x8d4\x01\x8bU\xfcH\x8bE\xe8H\x01\xd0\x0f\xb6\x00\xc1\xe0\x05\x89\xc1\x8bU\xfcH\x8bE\xe8H\x01\xd0\x8d\x14\x0e\x88\x10\x83E\xfc\x01\x8bE\xfc;E\xe4r\xac\x90\x90'
out_path = "mem_write_fixed.bin"
with open(out_path, "wb") as f:
f.write(data)
print(f"Wrote {len(data)} bytes to: {out_path}")
#!/usr/bin/env python3
import base64
b64 = "425MvHMxtLqZ3ty3RZkw3mwwulNRjkswbpkDMK+3CDCOtbe6kzAqPyrcEAI="
ct = base64.b64decode(b64)
def preimages(c,k):
res=[]
for b in range(256):
if ((40*b + (k ^ b)) & 0xFF) == c:
res.append(b)
return res
# 尝试所有 key，挑选能得到可打印 ASCII 的解
for k in range(256):
ok = True
out = []
for c in ct:
p = preimages(c,k)
# 只接受可打印 ASCII (space..~)
p_print = [x for x in p if 32 <= x <= 126]
if not p_print:
ok = False
break
# 若有多个可选，这里默认取第一个（你的题目能唯一决定）
out.append(p_print[0])
if ok:
s = bytes(out)
if b"flag" in s.lower() or b"{" in s:
print("key =", k)
print("plaintext =", s.decode())
break